fix(deps): update dependency tinymce to v5.10.8 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
tinymce (source)	5.10.7 -> 5.10.8

GitHub Vulnerability Alerts

CVE-2023-45818

Impact

A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before being stored in the undo stack. If the HTML snippet is restored from the undo stack, the combination of the string manipulation and reparative parsing by either the browser's native DOMParser API (TinyMCE 6) or the SaxParser API (TinyMCE 5) mutates the HTML maliciously, allowing an XSS payload to be executed.
​This vulnerability also impacts these related TinyMCE APIs and plugins:​

• tinymce.Editor.getContent({ format: 'raw' })
• tinymce.Editor.resetContent()
• Austosave Plugin

Patches

This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring HTML is trimmed using node-level manipulation instead of string manipulation.

Fix

To avoid this vulnerability:

• Upgrade to TinyMCE 5.10.8 or higher for TinyMCE 5.x.
• Upgrade to TinyMCE 6.7.1 or higher for TinyMCE 6.x.

References

• https://tiny.cloud/docs/release-notes/release-notes5108/#securityfixes
• https://tiny.cloud/docs/tinymce/6/6.7.1-release-notes/#security-fixes

For more information

If you have any questions or comments about this advisory:

• Email us at [email protected]
• Open an issue in the TinyMCE repo

CVE-2023-45819

Impact

A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions for this exploit requires carefully crafted malicious content to have been inserted into the editor and a notification to have been triggered.

When a notification was opened, the HTML within the text argument was displayed unfiltered in the notification. The vulnerability allowed arbitrary JavaScript execution when an notification presented in the TinyMCE UI for the current user. This issue could also be exploited by any integration which uses a TinyMCE notification to display unfiltered HTML content.

Patches

This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring that the HTML displayed in the notification is sanitized, preventing the exploit.

Fix

To avoid this vulnerability:

• Upgrade to TinyMCE 5.10.8 or higher for TinyMCE 5.x.
• Upgrade to TinyMCE 6.7.1 or higher for TinyMCE 6.x.

References

• https://tiny.cloud/docs/release-notes/release-notes5108/#securityfixes
• https://tiny.cloud/docs/tinymce/6/6.7.1-release-notes/#security-fixes

For more information

If you have any questions or comments about this advisory:

• Email us at [email protected]
• Open an issue in the TinyMCE repo

---

Release Notes

tinymce/tinymce (tinymce)

v5.10.8

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.