{"id":"GHSA-h96f-fc7c-9r55","aliases":[],"status":"published","title":"Regex denial of service vulnerability in codesample plugin","description":"### Impact\nA regex denial of service (ReDoS) vulnerability was discovered in a dependency of the `codesample` plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the `codesample` plugin using TinyMCE 5.5.1 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 5.6.0 by upgrading to a version of the dependency without the vulnerability.\n\n### Workarounds\nTo work around this vulnerability, either:\n- Upgrade to TinyMCE 5.6.0 or higher\n- Disable the `codesample` plugin\n- Disable ruby code samples using the [codesample_languages](https://www.tiny.cloud/docs/plugins/opensource/codesample/#exampleusingcodesample_languages) setting\n- Override the PrismJS syntax highlighter to version 1.21.0 or higher using the [codesample_global_prismjs](https://www.tiny.cloud/docs/plugins/opensource/codesample/#codesample_global_prismjs) setting\n\n### Acknowledgements\nTiny Technologies would like to thank Erik Krogh Kristensen at GitHub for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [TinyMCE repo](http://github.com/tinymce/tinymce/issues)\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2021-01-06T19:25:46Z","modified":"2023-01-09T05:04:25Z","fixes":[{"ecosystem":"npm","package":"tinymce","fixed_in":["5.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.0"}]}]},{"source":"osv","ecosystem":"npm","package":"tinymce","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.6.0"}]}]}],"references":[{"url":"https://github.com/tinymce/tinymce/security/advisories/GHSA-h96f-fc7c-9r55","tags":["web"]},{"url":"https://www.npmjs.com/package/tinymce","tags":["web"]},{"url":"https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h96f-fc7c-9r55"}],"sources":{"ghsa":[{"id":"GHSA-h96f-fc7c-9r55","title":"Regex denial of service vulnerability in codesample plugin","description":"### Impact\nA regex denial of service (ReDoS) vulnerability was discovered in a dependency of the `codesample` plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the `codesample` plugin using TinyMCE 5.5.1 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 5.6.0 by upgrading to a version of the dependency without the vulnerability.\n\n### Workarounds\nTo work around this vulnerability, either:\n- Upgrade to TinyMCE 5.6.0 or higher\n- Disable the `codesample` plugin\n- Disable ruby code samples using the [codesample_languages](https://www.tiny.cloud/docs/plugins/opensource/codesample/#exampleusingcodesample_languages) setting\n- Override the PrismJS syntax highlighter to version 1.21.0 or higher using the [codesample_global_prismjs](https://www.tiny.cloud/docs/plugins/opensource/codesample/#codesample_global_prismjs) setting\n\n### Acknowledgements\nTiny Technologies would like to thank Erik Krogh Kristensen at GitHub for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [TinyMCE repo](http://github.com/tinymce/tinymce/issues)\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)","status":"published","published":"2021-01-06T19:25:46Z","modified":"2023-01-09T05:04:25Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:09.554044Z"}],"osv":[{"id":"GHSA-h96f-fc7c-9r55","title":"Regex denial of service vulnerability in codesample plugin","description":"### Impact\nA regex denial of service (ReDoS) vulnerability was discovered in a dependency of the `codesample` plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the `codesample` plugin using TinyMCE 5.5.1 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 5.6.0 by upgrading to a version of the dependency without the vulnerability.\n\n### Workarounds\nTo work around this vulnerability, either:\n- Upgrade to TinyMCE 5.6.0 or higher\n- Disable the `codesample` plugin\n- Disable ruby code samples using the [codesample_languages](https://www.tiny.cloud/docs/plugins/opensource/codesample/#exampleusingcodesample_languages) setting\n- Override the PrismJS syntax highlighter to version 1.21.0 or higher using the [codesample_global_prismjs](https://www.tiny.cloud/docs/plugins/opensource/codesample/#codesample_global_prismjs) setting\n\n### Acknowledgements\nTiny Technologies would like to thank Erik Krogh Kristensen at GitHub for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [TinyMCE repo](http://github.com/tinymce/tinymce/issues)\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)","status":"published","published":"2021-01-06T19:25:46Z","modified":"2021-01-06T19:25:24Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}