CVE-2023-48219

Source
https://nvd.nist.gov/vuln/detail/CVE-2023-48219
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-48219.json
Aliases
Published
2023-11-15T19:15:07Z
Modified
2023-11-29T10:20:56.850844Z
Details

TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization according to the HTML standard. If such text nodes contain a special character reserved as an internal marker, they can be combined with other HTML patterns to form malicious snippets. These snippets pass the initial sanitisation layer when the content is parsed into the editor body, but can trigger XSS when the special internal marker is removed from the content and re-parsed. his vulnerability has been patched in TinyMCE versions 6.7.3 and 5.10.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

Affected packages

Git / github.com/tinymce/tinymce

Affected ranges

Type
GIT
Repo
https://github.com/tinymce/tinymce
Events

Affected versions

5.*

5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2

@ephox/acid@1.*

@ephox/acid@1.0.74
@ephox/acid@1.0.75
@ephox/acid@1.0.76
@ephox/acid@1.0.77
@ephox/acid@1.0.78
@ephox/acid@1.0.79
@ephox/acid@1.0.80
@ephox/acid@1.0.81

@ephox/acid@2.*

@ephox/acid@2.0.0
@ephox/acid@2.0.1
@ephox/acid@2.0.2
@ephox/acid@2.0.3
@ephox/acid@2.0.5

@ephox/acid@3.*

@ephox/acid@3.0.1
@ephox/acid@3.0.2
@ephox/acid@3.0.3
@ephox/acid@3.0.4
@ephox/acid@3.0.5

@ephox/acid@4.*

@ephox/acid@4.0.1
@ephox/acid@4.0.3
@ephox/acid@4.0.4

@ephox/agar@4.*

@ephox/agar@4.15.4
@ephox/agar@4.15.5
@ephox/agar@4.16.0
@ephox/agar@4.16.1
@ephox/agar@4.17.0
@ephox/agar@4.17.1
@ephox/agar@4.17.2

@ephox/agar@5.*

@ephox/agar@5.0.0
@ephox/agar@5.0.1
@ephox/agar@5.1.0
@ephox/agar@5.1.1
@ephox/agar@5.2.1
@ephox/agar@5.3.1
@ephox/agar@5.3.2
@ephox/agar@5.3.3
@ephox/agar@5.4.0
@ephox/agar@5.4.1

@ephox/agar@6.*

@ephox/agar@6.0.1
@ephox/agar@6.0.3
@ephox/agar@6.0.4

@ephox/alloy@7.*

@ephox/alloy@7.0.0
@ephox/alloy@7.0.1
@ephox/alloy@7.0.2
@ephox/alloy@7.0.3
@ephox/alloy@7.0.4
@ephox/alloy@7.0.5
@ephox/alloy@7.0.6
@ephox/alloy@7.0.7

@ephox/alloy@8.*

@ephox/alloy@8.0.0
@ephox/alloy@8.0.1
@ephox/alloy@8.1.0
@ephox/alloy@8.1.1
@ephox/alloy@8.1.3
@ephox/alloy@8.2.1
@ephox/alloy@8.2.2
@ephox/alloy@8.2.3
@ephox/alloy@8.2.4
@ephox/alloy@8.2.5

@ephox/alloy@9.*

@ephox/alloy@9.0.1
@ephox/alloy@9.0.3
@ephox/alloy@9.0.4

@ephox/boss@3.*

@ephox/boss@3.1.4
@ephox/boss@3.1.5
@ephox/boss@3.1.6
@ephox/boss@3.1.7
@ephox/boss@3.1.8
@ephox/boss@3.1.9

@ephox/boss@4.*

@ephox/boss@4.0.0
@ephox/boss@4.0.1
@ephox/boss@4.0.2
@ephox/boss@4.0.3
@ephox/boss@4.1.1
@ephox/boss@4.1.3
@ephox/boss@4.2.0
@ephox/boss@4.2.1

@ephox/boss@5.*

@ephox/boss@5.0.1
@ephox/boss@5.0.3
@ephox/boss@5.0.4

@ephox/boulder@4.*

@ephox/boulder@4.0.4
@ephox/boulder@4.0.5
@ephox/boulder@4.0.6
@ephox/boulder@4.0.7
@ephox/boulder@4.0.8

@ephox/boulder@5.*

@ephox/boulder@5.0.0
@ephox/boulder@5.0.1
@ephox/boulder@5.0.2
@ephox/boulder@5.0.3
@ephox/boulder@5.0.5
@ephox/boulder@5.0.7

@ephox/boulder@6.*

@ephox/boulder@6.0.1
@ephox/boulder@6.0.3

@ephox/bridge@1.*

@ephox/bridge@1.2.0
@ephox/bridge@1.2.1
@ephox/bridge@1.2.2
@ephox/bridge@1.2.3
@ephox/bridge@1.2.4

@ephox/bridge@2.*

@ephox/bridge@2.0.0
@ephox/bridge@2.0.1
@ephox/bridge@2.1.0
@ephox/bridge@2.1.1
@ephox/bridge@2.1.3
@ephox/bridge@2.2.0
@ephox/bridge@2.2.2

@ephox/bridge@3.*

@ephox/bridge@3.0.1
@ephox/bridge@3.0.2
@ephox/bridge@3.0.4

@ephox/darwin@4.*

@ephox/darwin@4.0.15
@ephox/darwin@4.0.16
@ephox/darwin@4.0.17
@ephox/darwin@4.0.18
@ephox/darwin@4.0.19
@ephox/darwin@4.0.20

@ephox/darwin@5.*

@ephox/darwin@5.0.0
@ephox/darwin@5.0.1
@ephox/darwin@5.0.2
@ephox/darwin@5.0.3
@ephox/darwin@5.0.4
@ephox/darwin@5.0.5

@ephox/darwin@6.*

@ephox/darwin@6.0.1
@ephox/darwin@6.0.3
@ephox/darwin@6.0.4
@ephox/darwin@6.0.5
@ephox/darwin@6.0.6
@ephox/darwin@6.0.7

@ephox/darwin@7.*

@ephox/darwin@7.0.1
@ephox/darwin@7.0.3
@ephox/darwin@7.0.4
@ephox/darwin@7.0.5

@ephox/dragster@4.*

@ephox/dragster@4.0.47
@ephox/dragster@4.0.48
@ephox/dragster@4.0.49
@ephox/dragster@4.0.50
@ephox/dragster@4.0.51
@ephox/dragster@4.0.52

@ephox/dragster@5.*

@ephox/dragster@5.0.0
@ephox/dragster@5.0.1
@ephox/dragster@5.0.2
@ephox/dragster@5.0.3
@ephox/dragster@5.0.5
@ephox/dragster@5.0.7
@ephox/dragster@5.0.8

@ephox/dragster@6.*

@ephox/dragster@6.0.1
@ephox/dragster@6.0.3
@ephox/dragster@6.0.4

@ephox/imagetools@3.*

@ephox/imagetools@3.3.0
@ephox/imagetools@3.3.1
@ephox/imagetools@3.3.2
@ephox/imagetools@3.3.3

@ephox/imagetools@4.*

@ephox/imagetools@4.0.0
@ephox/imagetools@4.0.1
@ephox/imagetools@4.0.2
@ephox/imagetools@4.0.3
@ephox/imagetools@4.0.5
@ephox/imagetools@4.0.7

@ephox/imagetools@5.*

@ephox/imagetools@5.0.1
@ephox/imagetools@5.1.1

@ephox/jax@4.*

@ephox/jax@4.1.32
@ephox/jax@4.1.33
@ephox/jax@4.1.34
@ephox/jax@4.1.35
@ephox/jax@4.1.36

@ephox/jax@5.*

@ephox/jax@5.0.0
@ephox/jax@5.0.1
@ephox/jax@5.0.2
@ephox/jax@5.0.3
@ephox/jax@5.0.5
@ephox/jax@5.0.7

@ephox/jax@6.*

@ephox/jax@6.0.1
@ephox/jax@6.0.3

@ephox/katamari-assertions@1.*

@ephox/katamari-assertions@1.0.5
@ephox/katamari-assertions@1.0.6
@ephox/katamari-assertions@1.0.7
@ephox/katamari-assertions@1.0.8
@ephox/katamari-assertions@1.0.9

@ephox/katamari-assertions@2.*

@ephox/katamari-assertions@2.0.0
@ephox/katamari-assertions@2.0.1
@ephox/katamari-assertions@2.0.2
@ephox/katamari-assertions@2.0.3
@ephox/katamari-assertions@2.0.5
@ephox/katamari-assertions@2.0.7

@ephox/katamari-assertions@3.*

@ephox/katamari-assertions@3.0.1
@ephox/katamari-assertions@3.0.3

@ephox/katamari@6.*

@ephox/katamari@6.0.0
@ephox/katamari@6.0.1
@ephox/katamari@6.1.0
@ephox/katamari@6.1.1
@ephox/katamari@6.1.2

@ephox/katamari@7.*

@ephox/katamari@7.0.0
@ephox/katamari@7.0.1
@ephox/katamari@7.1.0
@ephox/katamari@7.1.1
@ephox/katamari@7.1.3
@ephox/katamari@7.2.1

@ephox/katamari@8.*

@ephox/katamari@8.0.1
@ephox/katamari@8.1.1

@ephox/mcagar@4.*

@ephox/mcagar@4.1.5
@ephox/mcagar@4.1.6
@ephox/mcagar@4.2.0
@ephox/mcagar@4.2.1
@ephox/mcagar@4.2.2
@ephox/mcagar@4.2.3
@ephox/mcagar@4.2.4

@ephox/mcagar@5.*

@ephox/mcagar@5.0.0
@ephox/mcagar@5.0.1
@ephox/mcagar@5.1.0
@ephox/mcagar@5.1.1

@ephox/mcagar@6.*

@ephox/mcagar@6.0.1
@ephox/mcagar@6.1.1
@ephox/mcagar@6.1.2
@ephox/mcagar@6.1.3
@ephox/mcagar@6.1.4
@ephox/mcagar@6.1.5

@ephox/mcagar@7.*

@ephox/mcagar@7.0.1
@ephox/mcagar@7.0.2
@ephox/mcagar@7.0.4
@ephox/mcagar@7.0.5

@ephox/phoenix@5.*

@ephox/phoenix@5.1.10
@ephox/phoenix@5.1.5
@ephox/phoenix@5.1.6
@ephox/phoenix@5.1.7
@ephox/phoenix@5.1.8
@ephox/phoenix@5.1.9

@ephox/phoenix@6.*

@ephox/phoenix@6.0.0
@ephox/phoenix@6.0.1
@ephox/phoenix@6.0.10
@ephox/phoenix@6.0.2
@ephox/phoenix@6.0.3
@ephox/phoenix@6.0.5
@ephox/phoenix@6.0.7
@ephox/phoenix@6.0.8
@ephox/phoenix@6.0.9

@ephox/phoenix@7.*

@ephox/phoenix@7.0.1
@ephox/phoenix@7.0.3
@ephox/phoenix@7.0.4

@ephox/polaris@3.*

@ephox/polaris@3.0.49
@ephox/polaris@3.0.50
@ephox/polaris@3.0.51
@ephox/polaris@3.0.52
@ephox/polaris@3.0.53

@ephox/polaris@4.*

@ephox/polaris@4.0.0
@ephox/polaris@4.0.1
@ephox/polaris@4.0.2
@ephox/polaris@4.0.3
@ephox/polaris@4.0.5
@ephox/polaris@4.0.7
@ephox/polaris@4.0.8

@ephox/polaris@5.*

@ephox/polaris@5.0.1
@ephox/polaris@5.0.3
@ephox/polaris@5.0.4

@ephox/porkbun@4.*

@ephox/porkbun@4.0.34
@ephox/porkbun@4.0.35
@ephox/porkbun@4.0.36
@ephox/porkbun@4.0.37
@ephox/porkbun@4.0.38

@ephox/porkbun@5.*

@ephox/porkbun@5.0.0
@ephox/porkbun@5.0.1
@ephox/porkbun@5.0.2
@ephox/porkbun@5.0.3
@ephox/porkbun@5.0.5
@ephox/porkbun@5.0.7

@ephox/porkbun@6.*

@ephox/porkbun@6.0.1
@ephox/porkbun@6.0.3

@ephox/robin@7.*

@ephox/robin@7.0.52
@ephox/robin@7.0.53
@ephox/robin@7.0.54
@ephox/robin@7.0.55
@ephox/robin@7.0.56
@ephox/robin@7.0.57

@ephox/robin@8.*

@ephox/robin@8.0.0
@ephox/robin@8.0.1
@ephox/robin@8.0.2
@ephox/robin@8.0.3
@ephox/robin@8.0.4
@ephox/robin@8.0.6
@ephox/robin@8.0.8
@ephox/robin@8.0.9
@ephox/robin@8.1.0
@ephox/robin@8.1.1

@ephox/robin@9.*

@ephox/robin@9.0.1
@ephox/robin@9.0.3
@ephox/robin@9.0.4

@ephox/sand@3.*

@ephox/sand@3.1.10
@ephox/sand@3.1.11
@ephox/sand@3.1.7
@ephox/sand@3.1.8
@ephox/sand@3.1.9

@ephox/sand@4.*

@ephox/sand@4.0.0
@ephox/sand@4.0.1
@ephox/sand@4.0.2
@ephox/sand@4.0.3
@ephox/sand@4.0.5
@ephox/sand@4.0.7
@ephox/sand@4.0.8

@ephox/sand@5.*

@ephox/sand@5.0.1
@ephox/sand@5.0.3

@ephox/snooker@10.*

@ephox/snooker@10.0.1
@ephox/snooker@10.0.2

@ephox/snooker@5.*

@ephox/snooker@5.1.13
@ephox/snooker@5.1.14

@ephox/snooker@6.*

@ephox/snooker@6.0.0
@ephox/snooker@6.0.1
@ephox/snooker@6.0.2
@ephox/snooker@6.0.3

@ephox/snooker@7.*

@ephox/snooker@7.0.0
@ephox/snooker@7.0.1
@ephox/snooker@7.0.2
@ephox/snooker@7.1.0
@ephox/snooker@7.1.1
@ephox/snooker@7.1.2

@ephox/snooker@8.*

@ephox/snooker@8.0.1
@ephox/snooker@8.0.3
@ephox/snooker@8.0.4
@ephox/snooker@8.0.5
@ephox/snooker@8.0.6
@ephox/snooker@8.0.7

@ephox/snooker@9.*

@ephox/snooker@9.0.1

@ephox/sugar@6.*

@ephox/sugar@6.0.0
@ephox/sugar@6.0.1
@ephox/sugar@6.1.0
@ephox/sugar@6.1.1
@ephox/sugar@6.1.2
@ephox/sugar@6.1.3

@ephox/sugar@7.*

@ephox/sugar@7.0.0
@ephox/sugar@7.0.1
@ephox/sugar@7.0.2
@ephox/sugar@7.0.3
@ephox/sugar@7.1.1
@ephox/sugar@7.1.3
@ephox/sugar@7.1.4

@ephox/sugar@8.*

@ephox/sugar@8.0.1
@ephox/sugar@8.1.1
@ephox/sugar@8.1.2

@tinymce/oxide-icons-default@1.*

@tinymce/oxide-icons-default@1.3.2
@tinymce/oxide-icons-default@1.3.3
@tinymce/oxide-icons-default@1.4.0
@tinymce/oxide-icons-default@1.4.1
@tinymce/oxide-icons-default@1.5.0
@tinymce/oxide-icons-default@1.5.1
@tinymce/oxide-icons-default@1.6.1

@tinymce/oxide@1.*

@tinymce/oxide@1.10.1
@tinymce/oxide@1.3.0
@tinymce/oxide@1.3.1
@tinymce/oxide@1.3.2
@tinymce/oxide@1.3.3
@tinymce/oxide@1.4.0
@tinymce/oxide@1.4.1
@tinymce/oxide@1.4.2
@tinymce/oxide@1.5.0
@tinymce/oxide@1.5.1
@tinymce/oxide@1.6.0
@tinymce/oxide@1.6.1
@tinymce/oxide@1.7.1
@tinymce/oxide@1.8.1
@tinymce/oxide@1.9.1