GHSA-4q66-g4mm-8rg5
Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE
GHSA-4q66-g4mm-8rg5 is a medium vulnerability (CVSS 5.4) in silverstripe/admin, published July 31, 2023. No source lists public exploit code. Fixed in silverstripe/admin 1.13.6.
- Severity
- 5.4 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.13.6silverstripe/admin +1 more
Description
TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin.
Only Silverstripe CMS 4 is affected by this issue. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in silverstripe/admin.
Silverstripe CMS 5 is not affected by those vulnerabilities because it uses TinyMCE 6.
You can find more information about the underlying vulnerabilities in those GitHub security advisories:
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/adminPackagist | before 1.13.6 | 1.13.6 |
silverstripe/adminPackagist | before 1.13.6, plus listed versions 1.0.01.0.0-alpha61.0.0-alpha71.0.0-beta11.0.0-beta2 Show 45 moreShow less1.0.0-beta31.0.0-beta41.0.0-rc11.0.0-rc21.0.0-rc31.0.11.0.1-rc11.0.21.0.31.0.41.0.51.0.61.0.71.1.01.1.0-rc11.1.0-rc21.1.11.1.21.1.31.1.41.1.51.10.01.10.0-beta11.10.0-rc11.10.11.10.21.10.31.10.41.11.01.11.0-beta11.11.0-rc11.11.11.11.21.11.31.12.01.12.0-beta11.12.0-rc11.12.11.12.21.12.31.12.41.12.51.12.61.12.71.13.0 | 1.13.6 |
What each source reports
GitHub Advisories Score used
Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE
TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin.
Only Silverstripe CMS 4 is affected by this issue. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in silverstripe/admin.
Silverstripe CMS 5 is not affected by those vulnerabilities because it uses TinyMCE 6.
You can find more information about the underlying vulnerabilities in those GitHub security advisories:
- Record
GHSA-4q66-g4mm-8rg5- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSV
Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE
TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin.
Only Silverstripe CMS 4 is affected by this issue. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in silverstripe/admin.
Silverstripe CMS 5 is not affected by those vulnerabilities because it uses TinyMCE 6.
You can find more information about the underlying vulnerabilities in those GitHub security advisories:
- Record
GHSA-4q66-g4mm-8rg5- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/silverstripe/silverstripe-admin/security/advisories/GHSA-4q66-g4mm-8rg5
Left out here: 57 versions. The JSON record has them.