CVE-2023-45818

Summary

CVE-2023-45818 is a new cross-site scripting (XSS) vulnerability affecting TinyMCE, a popular open-source rich text editor. The core undo and redo functionality of TinyMCE was found to be susceptible to a mutation XSS attack. When a specially crafted HTML snippet bypasses TinyMCE's XSS sanitization, it is manipulated as a string for storage in the undo stack. Restoring the HTML snippet from the undo stack results in malicious string manipulation and parsing by the browser's DOMParser API (TinyMCE 6) or SaxParser API (TinyMCE 5). This vulnerability has been addressed in TinyMCE 5.10.8 and TinyMCE 6.7.1 through improvements in HTML trimming methods. Users are strongly advised to upgrade to the latest versions to mitigate this risk, as no known workarounds exist.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.