NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
HIGH severity

Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG EditorGHSA-9j5w-2cqc-cwj9

HIGHFix: OpenMage/magento-lts#3220

GHSA-9j5w-2cqc-cwj9 is a high-severity (CVSS 7.5) vulnerability in openmage/magento-lts. A fix is available for openmage/magento-lts — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Dec 4, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐘openmage/magento-lts

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

From HackerOne report #1948040 by Halit AKAYDIN (hltakydn)

Impact

What kind of vulnerability is it? Who is impacted?

The TinyMCE WYSIWYG editor fails to filter scripts when rendering the HTML in specially crafted HTML tags.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability was fixed in version 20.2.0 by upgrading TinyMCE to a recent version in https://github.com/OpenMage/magento-lts/pull/3220

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

The WYSIWYG editor features could be disabled in the configuration. Possibly some WAF appliances would filter this attack.

References

Are there any links users can visit to find out more?

The attack is simply an exploit of the "onmouseover" attribute of an img element as described on OWASP XSS Filter Evasion

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistopenmage/magento-ltsall versions20.2.0composer require openmage/magento-lts:^20.2.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for openmage/magento-lts, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update openmage/magento-lts to 20.2.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-9j5w-2cqc-cwj9 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

From HackerOne report [#1948040](https://hackerone.com/reports/1948040) by Halit AKAYDIN (hltakydn) ### Impact _What kind of vulnerability is it? Who is impacted?_ The TinyMCE WYSIWYG editor fails to filter scripts when rendering the HTML in specially crafted HTML tags. ### Patches _Has the problem been patched? What versions should users upgrade to?_ This vulnerability was fixed in version 20.2.0 by upgrading TinyMCE to a recent version in https://github.com/OpenMage/magento-lts/pull/3220 ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_
O3 Security · Impact-Aware SCA

Is GHSA-9j5w-2cqc-cwj9 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Magento LTS vulnerable to Stored XSS via TinyMCE…