{"id":"GHSA-vrv8-v4w8-f95h","summary":"Cross-site scripting vulnerability in TinyMCE","details":"### Impact\nA cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 4.9.11 and 5.4.1 by improved HTML parsing and sanitization logic.\n\n### Workarounds\nThe workarounds available are:\n- upgrade to either TinyMCE 4.9.11 or TinyMCE 5.4.1\nor\n- enable the media plugin, which overrides the default parsing behaviour for iframes\nor\n- add the following workaround to update the parsing schema rules for iframes:\n\n#### Example: Change the default schema for iframes\n```js\nsetup: function(editor) {\n  editor.on('PreInit', function() {\n    editor.schema.getSpecialElements()['iframe'] = /\u003c/iframe[^\u003e]*\u003e/gi;\n  });\n}\n```\n\n### Acknowledgements\nTiny Technologies would like to thank George Steketee and Chris Davis at [Bishop Fox](https://www.bishopfox.com/) for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)","aliases":["CVE-2020-12648"],"modified":"2023-11-08T04:02:10.978052Z","published":"2020-08-11T14:55:01Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2020-08-10T22:39:05Z","nvd_published_at":"2020-08-14T14:15:00Z"},"references":[{"type":"WEB","url":"https://github.com/tinymce/tinymce/security/advisories/GHSA-vrv8-v4w8-f95h"},{"type":"WEB","url":"https://github.com/tinymce/tinymce/pull/5843"},{"type":"WEB","url":"https://github.com/tinymce/tinymce/commit/2b71c922214d388838d930806207a66c14e80f63"},{"type":"WEB","url":"https://github.com/tinymce/tinymce/commit/696e43658dc9750ec24fdc4650bd2be9653daf5b"},{"type":"PACKAGE","url":"https://github.com/tinymce/tinymce"},{"type":"WEB","url":"https://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes"}],"affected":[{"package":{"name":"tinymce","ecosystem":"npm","purl":"pkg:npm/tinymce"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.9.11"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-vrv8-v4w8-f95h/GHSA-vrv8-v4w8-f95h.json"}},{"package":{"name":"tinymce","ecosystem":"npm","purl":"pkg:npm/tinymce"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.4.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-vrv8-v4w8-f95h/GHSA-vrv8-v4w8-f95h.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}