-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commit diff shows critical modifications to TinyMCE's sanitization logic: 1) isInvalidUri was updated to include tag-specific SVG data URI checks, addressing GHSA-w7jx-j77m-wp65 (XSS via media elements). 2) parseAttribute was modified to pass tag context to URI validation, closing an XSS vector. 3) New removeOrUnwrapInvalidNode function and related changes address GHSA-5h9g-x5rv-25wg by ensuring schema validation persists after node unwrapping. These directly correspond to the referenced TinyMCE advisories and match the described XSS vulnerabilities.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/admin | composer | < 1.13.6 | 1.13.6 |