| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| TinyMCE | ≥ 6.0.0, < 7.9.3≥ 8.0.0, < 8.5.1≤ 5.10.9 | 7.9.38.5.1 |
| tinymce/tinymce | ≥ 6.0.0, < 7.9.3≥ 8.0.0, < 8.5.1≤ 5.10.9 | 7.9.38.5.1 |
| tinymce | ≥ 6.0.0, < 7.9.3≥ 8.0.0, < 8.5.1< 5.11.1 | 7.9.38.5.15.11.1 |
| tinymce | ≥ 6.0.0, < 7.9.3≥ 8.0.0, < 8.5.1≤ 5.10.9 | 7.9.38.5.1 |
Stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation.
Patched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x).
No official workaround available.
To avoid this vulnerability:
Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract).
Tiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí