TinyMCE Cross-Site Scripting (XSS) vulnerability

[kburisma]

Hi! Just reaching out about the update status of tinymce-vue. Got a heads up from npm today about an XSS bug in TinyMCE, set to be fixed in version 7.0.

TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78

If there's any chance we'll see an update roll out soon to address this?

Thanks a bunch!

[Edgaraszs]

There is a lot more vulnerabilities would be nice to get update to 7.0

[Afraithe]

We are working on an update to the vue package.

[meirroth]

@Afraithe Awesome, can't wait!

[719media]

@Afraithe any word on a new version?

[meirroth]

Looks like this issue should be resolved with #408

[tiny-stale-bot]

This issue is stale because it has been open 30 days with no activity. Please comment if you wish to keep this issue open or it will be closed in 7 days.

[danoaky-tiny]

This has now been fixed in a recent release, closing.