TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements

TRUNG BÌNH 6.1CVE-2024-29881 · GHSA-5359-pvf2-pw78 · Công bố 26/03/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-29881 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng TinyMCE, tinymce/tinymce, tinymce (tiny).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.71%, cao hơn 53.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 7.0.0, 6.8.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
TinyMCE NuGet	`< 7.0.0`	`7.0.0`
tinymce/tinymce Packagist	`< 7.0.0`	`7.0.0`
tinymce tiny	`≥ 6.8.2, < 7.0.0< 6.8.1`	`7.0.06.8.1`
tinymce npm	`< 7.0.0`	`7.0.0`

Mô tả

Impact

A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or embed element and that image could potentially contain a XSS payload.

Fix

TinyMCE 6.8.1 introduced a new convert_unsafe_embeds option to automatically convert object and embed elements respective of their type attribute. From TinyMCE 7.0.0 onwards, the convert_unsafe_embeds option is enabled by default.

Workarounds

If you are using TinyMCE 6.8.1 or higher, set convert_unsafe_embeds to true. For any earlier versions, a custom NodeFilter is recommended to remove or modify any object or embed elements. This can be added using the editor.parser.addNodeFilter and editor.serializer.addNodeFilter APIs.

Acknowledgements

Tiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability.

References

Mô tả của NVD

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an `object` or `embed` element and that image could potentially contain a XSS payload. This vulnerability is fixed in 6.8.1 and 7.0.0.