Giters

voidlabs / mosaico

Mosaico - Responsive Email Template Editor

Home Page:https://mosaico.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

tinymce 4.x has a vulnerability, could mosaico be distributed with 5.x by default?

BarbieroDB1 opened this issue · comments

commented

CVE-2022-23494 seems to affect tinyMCE versions <5, and mosaico currently uses tinyMCE v4.9.11 as default. #644 added support for newer tinyMCE versions and, indeed, I could just npm install tinymce@5 and then use grunt build(with a few gruntfile changes) to create a mosaico distribution that uses tinyMCE 5.10.7 instead of the vulnerable 4.9.

However, package.json.NOTES state

  • tinymce is "locked" to 4.9.x because our skin, build code, and css overrides
    still rely on 4.x.

Are there any plans of updating mosaico to ship with tinyMCE 5 by default? Or maybe a separate branch? Is current mosaico even vulnerable to CVE-2022-23494 due to the underlying tinyMCE?

What's the status on this?