Impact A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or embed element and that image could potentially contain a XSS payload.
Fix TinyMCE 6.8.1 introduced a new convertunsafeembeds option to automatically convert object and embed elements respective of their type attribute. From TinyMCE 7.0.0 onwards, the convertunsafeembeds option is enabled by default.
Workarounds If you are using TinyMCE 6.8.1 or higher, set convertunsafeembeds to true. For any earlier versions, a custom NodeFilter is recommended to remove or modify any object or embed elements. This can be added using the editor.parser.addNodeFilter and editor.serializer.addNodeFilter APIs.
Acknowledgements Tiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability.
References - TinyMCE 6.8.1 - TinyMCE 7.0.0
Impact A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed iframe elements containing malicious code to execute when inserted into the editor. These iframe elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets.
Fix TinyMCE 6.8.1 introduced a new sandboxiframes boolean option which adds the sandbox="" attribute to every iframe element by default when enabled. This will prevent cross-origin, and in special cases same-origin, XSS by embedded resources in iframe elements. From TinyMCE 7.0.0 onwards the default value of this option is true.
In TinyMCE 7.0.0 a new sandboxiframesexclusions option was also added, allowing a list of domains to be specified that should be excluded from having the sandbox="" attribute applied when the sandboxiframes option is enabled. By default, this option is set to an array of domains that are provided in embed code by popular websites. To sandbox iframe elements from every domain, set this option to [].
Workarounds The HTTP Content-Security-Policy (CSP) frame-src or object-src can be configured to restrict or block the loading of unauthorized URLS. Refer to the TinyMCE Content Security Policy Guide.
References - TinyMCE 6.8.1 - TinyMCE 7.0.0