npm/tinymce CVE-2023-48219: medium 6.1, EPSS 0.71%
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
Action: Upgrade tinymce to 5.10.9 (5.x) or 6.7.3 (6.x) or later.
npm i tinymce@5.10.9npm i tinymce@6.7.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.10.9 | - |
| 6.0.0 | 6.7.3 | - |
Fixed versions
| 5.10.9 | 6.7.3 |
Sources
- osv: GHSA-v626-r774-j7f8
- https://github.com/tinymce/tinymce/security/advisories/GHSA-v626-r774-j7f8
- https://nvd.nist.gov/vuln/detail/CVE-2023-48219
- https://github.com/tinymce/tinymce
- https://github.com/tinymce/tinymce/releases/tag/5.10.9
- https://github.com/tinymce/tinymce/releases/tag/6.7.3
- https://tiny.cloud/docs/release-notes/release-notes5109
- https://tiny.cloud/docs/tinymce/6/6.7.3-release-notes
CVE-2023-48219 · published · modified · JSON