npm/tinymce CVE-2023-45818: medium 6.1, EPSS 0.76%
TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin
Action: Upgrade tinymce to 5.10.8 (5.x) or 6.7.1 (6.x) or later.
npm i tinymce@6.7.1npm i tinymce@5.10.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0 | 6.7.1 | - |
| 0 | 5.10.8 | - |
Fixed versions
| 6.7.1 | 5.10.8 |
Sources
- osv: GHSA-v65r-p3vv-jjfv
- https://github.com/tinymce/tinymce/security/advisories/GHSA-v65r-p3vv-jjfv
- https://nvd.nist.gov/vuln/detail/CVE-2023-45818
- https://github.com/tinymce/tinymce
- https://researchgate.net/publication/266654651_mXSS_attacks_Attacking_well-secured_web-applications_by_using_innerHTML_mutations
- https://tiny.cloud/docs/release-notes/release-notes5108/#securityfixes
- https://tiny.cloud/docs/tinymce/6/6.7.1-release-notes/#security-fixes
- https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.saxparser
CVE-2023-45818 · published · modified · JSON