CVE-2024-29881: TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
Impact A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or embed element and that image could potentially contain a XSS payload.
Fix TinyMCE 6.8.1 introduced a new convertunsafeembeds option to automatically convert object and embed elements respective of their type attribute. From TinyMCE 7.0.0 onwards, the convertunsafeembeds option is enabled by default.
Workarounds If you are using TinyMCE 6.8.1 or higher, set convertunsafeembeds to true. For any earlier versions, a custom NodeFilter is recommended to remove or modify any object or embed elements. This can be added using the editor.parser.addNodeFilter and editor.serializer.addNodeFilter APIs.
Acknowledgements Tiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability.
References - TinyMCE 6.8.1 - TinyMCE 7.0.0
Other sources
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or embed element and that image could potentially contain a XSS payload. This vulnerability is fixed in 6.8.1 and 7.0.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/TinyMCEto a version that resolves this vulnerability.Fixed in 7.0.0 - Upgrade
Upgrade
npm/tinymceto a version that resolves this vulnerability.Fixed in 7.0.0 - Upgrade
Upgrade
composer/tinymce/tinymceto a version that resolves this vulnerability.Fixed in 7.0.0 - Upgrade
Upgrade
TinyMCEto a version that resolves this vulnerability.Fixed in 6.8.1 - Configuration
For TinyMCE 6.8.1 or higher, set convert_unsafe_embeds to true; this option is enabled by default from TinyMCE 7.0.0 onwards.
TinyMCE convert_unsafe_embeds = true - Compensating control
For earlier TinyMCE versions, add a custom NodeFilter using the editor.parser.addNodeFilter and editor.serializer.addNodeFilter APIs to remove or modify object and embed elements.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29881?
CVE-2024-29881 is classified as a moderate severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2024-29881?
To fix CVE-2024-29881, upgrade TinyMCE to version 7.0.0 or later.
What software is affected by CVE-2024-29881?
CVE-2024-29881 affects TinyMCE versions prior to 7.0.0 across various package sources including NuGet, npm, and Composer.
Can CVE-2024-29881 lead to data breaches?
Yes, if exploited, CVE-2024-29881 could potentially allow attackers to execute arbitrary scripts leading to data theft.
What type of attack does CVE-2024-29881 include?
CVE-2024-29881 includes a cross-site scripting (XSS) attack vector via unsafe SVG image embedding.