CVE-2023-45818

Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin

Description

TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before being stored in the undo stack. If the HTML snippet is restored from the undo stack, the combination of the string manipulation and reparative parsing by either the browser's native [DOMParser API](https://developer.mozilla.org/en-US/docs/Web/API/DOMParser) (TinyMCE 6) or the SaxParser API (TinyMCE 5) mutates the HTML maliciously, allowing an XSS payload to be executed. This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring HTML is trimmed using node-level manipulation instead of string manipulation. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Category

6.1
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 1.28% Top 25%
Vendor Advisory github.com
Affected: tinymce tinymce
Published at:
Updated at:

References

Link Tags
https://github.com/tinymce/tinymce/security/advisories/GHSA-v65r-p3vv-jjfv vendor advisory
https://researchgate.net/publication/266654651_mXSS_attacks_Attacking_well-secured_web-applications_by_using_innerHTML_mutations third party advisory
https://tiny.cloud/docs/release-notes/release-notes5108/#securityfixes release notes
https://tiny.cloud/docs/tinymce/6/6.7.1-release-notes/#security-fixes release notes
https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.saxparser/ product

Frequently Asked Questions

What is the severity of CVE-2023-45818?
CVE-2023-45818 has been scored as a medium severity vulnerability.
How to fix CVE-2023-45818?
To fix CVE-2023-45818, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-45818 being actively exploited in the wild?
It is possible that CVE-2023-45818 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-45818?
CVE-2023-45818 affects tinymce tinymce.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.