Text Editor Component Allows Malicious Scripts via Embedded Images

Vulnerability Explanation

TinyMCE's content parsing pipeline did not sanitize or convert `<object>` and `<embed>` elements that reference external SVG files. Because SVG is an XML-based format that supports embedded `<script>` tags and event handlers, an attacker who can insert content into the editor can craft an SVG file containing arbitrary JavaScript. When the editor loads or serializes that content, the SVG payload executes in the victim's browser context. The attack requires user interaction (a victim must view the crafted content), which limits severity, but no authentication is required on the attacker's side to craft the payload.

Root Cause

TinyMCE's parser and serializer did not include a node filter to intercept and convert `<object>` and `<embed>` elements before rendering. The `convert_unsafe_embeds` option — which converts these elements to safer alternatives (`<img>`, `<video>`, `<audio>`, or `<iframe>`) based on MIME type — was introduced in TinyMCE 6.8.1 but defaulted to `false`, leaving installations unprotected unless explicitly opted in. TinyMCE 7.0.0 changed this default to `true`.

Technical Impact

An attacker who can insert content into a TinyMCE editor instance (e.g., via a CMS, comment system, or form) can execute arbitrary JavaScript in the browsers of users who subsequently view that content. Practical outcomes include session cookie theft, credential harvesting via fake login prompts, UI redirection, and actions performed on behalf of the victim within the application.

Severity Justification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N — Network-accessible, low complexity, no privileges required, but requires user interaction and impact is limited to confidentiality (e.g., cookie/session theft). Rated Medium by GitHub Advisory and Miggo.

Affected Components

• tinymce (npm) < 7.0.0
• TinyMCE (NuGet) < 7.0.0
• tinymce/tinymce (Composer) < 7.0.0

Remediation Steps

1. **Preferred fix — Upgrade to TinyMCE 7.0.0+:** This version enables `convert_unsafe_embeds` by default, converting `<object>` and `<embed>` elements to safer HTML alternatives automatically. No additional configuration is required after upgrading.
2. **Short-term workaround for TinyMCE 6.8.1–6.x:** Add `convert_unsafe_embeds: true` to your TinyMCE `init()` configuration. This activates the same protective node filter without requiring a major version upgrade.
3. **For TinyMCE versions below 6.8.1:** Implement a custom NodeFilter using `editor.parser.addNodeFilter` and `editor.serializer.addNodeFilter` to strip or replace `object` and `embed` elements before they are rendered or serialized.
4. **Test in staging first:** If upgrading from TinyMCE 6.x to 7.x, review the 7.0 release notes for any breaking changes relevant to your editor configuration before deploying to production.
5. **Audit content already stored:** If untrusted users have been able to submit content through the editor, consider scanning stored HTML content for `<object>` and `<embed>` elements referencing SVG files and sanitizing them.

Verification Steps

1. After upgrading or applying the config change, open the browser DevTools console on a page with the TinyMCE editor and run: `tinymce.activeEditor.settings.convert_unsafe_embeds` — it should return `true`.
2. Attempt to insert `<object data="test.svg" type="image/svg+xml"></object>` via the editor's source view. After saving and reloading, verify the element has been converted to a safer alternative (e.g., `<iframe>`) rather than rendered as-is.
3. Check your `package.json`, `composer.json`, or NuGet package list to confirm the installed TinyMCE version is 7.0.0 or higher.

Code Examples (javascript)

// TinyMCE 6.x default — convert_unsafe_embeds is false (omitted or not set)
tinymce.init({
  selector: '#editor',
  plugins: 'link image'
  // No convert_unsafe_embeds setting — object/embed SVGs are NOT sanitized
});

// Option A: Upgrade to TinyMCE 7.0.0+ (convert_unsafe_embeds is true by default)
// No config change needed after upgrading.

// Option B: Stay on TinyMCE 6.8.1+ and explicitly enable the option
tinymce.init({
  selector: '#editor',
  plugins: 'link image',
  convert_unsafe_embeds: true  // Converts <object>/<embed> SVGs to safer elements
});

// Option C: TinyMCE < 6.8.1 — custom NodeFilter workaround
editor.on('init', function () {
  editor.parser.addNodeFilter('object,embed', function (nodes) {
    nodes.forEach(function (node) {
      node.remove(); // or replace with a safe alternative
    });
  });
});

Best Practices

• Pin TinyMCE to a specific minor version in your dependency manifest and review release notes before upgrading, especially across major versions.
• Apply a Content Security Policy (CSP) header that restricts `script-src` to trusted origins — this provides a defence-in-depth layer that limits the damage of any XSS that does execute.
• If your application accepts user-generated HTML content, run server-side HTML sanitization (e.g., DOMPurify on the server, or a library like `html-sanitizer`) in addition to relying on client-side editor protections.
• Subscribe to security advisories for all third-party editor and UI libraries in your stack (e.g., via GitHub Dependabot or the Tiny Cloud security advisory feed).

References

• github.com/tinymce/tinymce/security/advisories/GHSA-5359-pvf2-pw78
• nvd.nist.gov/vuln/detail/CVE-2024-29881
• www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes/
• www.tiny.cloud/docs/tinymce/7/7.0-release-notes/
• github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1