CVE-2024-29881: TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
Impact A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or embed element and that image could potentially contain a XSS payload.
Fix TinyMCE 6.8.1 introduced a new convertunsafeembeds option to automatically convert object and embed elements respective of their type attribute. From TinyMCE 7.0.0 onwards, the convertunsafeembeds option is enabled by default.
Workarounds If you are using TinyMCE 6.8.1 or higher, set convertunsafeembeds to true. For any earlier versions, a custom NodeFilter is recommended to remove or modify any object or embed elements. This can be added using the editor.parser.addNodeFilter and editor.serializer.addNodeFilter APIs.
Acknowledgements Tiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability.
References - TinyMCE 6.8.1 - TinyMCE 7.0.0
Other sources
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or embed element and that image could potentially contain a XSS payload. This vulnerability is fixed in 6.8.1 and 7.0.0.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29881?
CVE-2024-29881 is classified as a moderate severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2024-29881?
To fix CVE-2024-29881, upgrade TinyMCE to version 7.0.0 or later.
What software is affected by CVE-2024-29881?
CVE-2024-29881 affects TinyMCE versions prior to 7.0.0 across various package sources including NuGet, npm, and Composer.
Can CVE-2024-29881 lead to data breaches?
Yes, if exploited, CVE-2024-29881 could potentially allow attackers to execute arbitrary scripts leading to data theft.
What type of attack does CVE-2024-29881 include?
CVE-2024-29881 includes a cross-site scripting (XSS) attack vector via unsafe SVG image embedding.