Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-29881

CVE-2024-29881: TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements

4.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-29881
GHSA ID
GHSA-5359-pvf2-pw78
EPSS Score
0.41451%
CWE
CWE-79
Published
3/26/2024
Updated
3/26/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
tinymce/tinymcecomposer< 7.0.07.0.0
tinymcenpm< 7.0.07.0.0
TinyMCEnuget< 7.0.07.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from TinyMCE's handling of 'object' and 'embed' elements containing SVG files. The commit diff shows the critical fix was adding a node filter in ParserFilters.ts that converts these elements to safer alternatives based on MIME type. Before this fix (versions <7.0.0), the register function did not include this filter, leaving the parser vulnerable to XSS via unprocessed object/embed elements. The addition of the convert_unsafe_embeds option and associated filtering logic in this function directly addresses the vulnerability, confirming its role in the exploit path.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t * [*ross-sit* s*riptin* (XSS)](*ttps://ow*sp.or*/www-*ommunity/*tt**ks/xss/) vuln*r**ility w*s *is*ov*r** in TinyM**’s *ont*nt lo**in* *n* *ont*nt ins*rtin* *o**. * SV* im*** *oul* ** lo**** t*ou** *n `o*j**t` or `*m***` *l*m*nt *n* t**t i

Reasoning

T** vuln*r**ility st*ms *rom TinyM**'s **n*lin* o* 'o*j**t' *n* '*m***' *l*m*nts *ont*inin* SV* *il*s. T** *ommit *i** s*ows t** *riti**l *ix w*s ***in* * no** *ilt*r in P*rs*r*ilt*rs.ts t**t *onv*rts t**s* *l*m*nts to s***r *lt*rn*tiv*s **s** on MIM