{"action":"closed","issue":{"url":"https://api.github.com/repos/tinymce/tinymce/issues/645","repository_url":"https://api.github.com/repos/tinymce/tinymce","labels_url":"https://api.github.com/repos/tinymce/tinymce/issues/645/labels{/name}","comments_url":"https://api.github.com/repos/tinymce/tinymce/issues/645/comments","events_url":"https://api.github.com/repos/tinymce/tinymce/issues/645/events","html_url":"https://github.com/tinymce/tinymce/issues/645","id":113927620,"number":645,"title":"Reflected DOM XSS Vulnerability in the TinyMCE Insert/Edit Image window","user":{"login":"TinyMCE-User","id":14879844,"avatar_url":"https://avatars.githubusercontent.com/u/14879844?v=3","gravatar_id":"","url":"https://api.github.com/users/TinyMCE-User","html_url":"https://github.com/TinyMCE-User","followers_url":"https://api.github.com/users/TinyMCE-User/followers","following_url":"https://api.github.com/users/TinyMCE-User/following{/other_user}","gists_url":"https://api.github.com/users/TinyMCE-User/gists{/gist_id}","starred_url":"https://api.github.com/users/TinyMCE-User/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TinyMCE-User/subscriptions","organizations_url":"https://api.github.com/users/TinyMCE-User/orgs","repos_url":"https://api.github.com/users/TinyMCE-User/repos","events_url":"https://api.github.com/users/TinyMCE-User/events{/privacy}","received_events_url":"https://api.github.com/users/TinyMCE-User/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/tinymce/tinymce/labels/browser:%20chrome","name":"browser: chrome","color":"ededed"},{"url":"https://api.github.com/repos/tinymce/tinymce/labels/browser:%20firefox","name":"browser: firefox","color":"ededed"},{"url":"https://api.github.com/repos/tinymce/tinymce/labels/browser:%20ie","name":"browser: ie","color":"ededed"},{"url":"https://api.github.com/repos/tinymce/tinymce/labels/browser:%20opera","name":"browser: opera","color":"ededed"},{"url":"https://api.github.com/repos/tinymce/tinymce/labels/browser:%20safari","name":"browser: safari","color":"ededed"},{"url":"https://api.github.com/repos/tinymce/tinymce/labels/origin:%20tinymce.com","name":"origin: tinymce.com","color":"ededed"},{"url":"https://api.github.com/repos/tinymce/tinymce/labels/type:%20bug","name":"type: bug","color":"555555"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2013-05-03T19:17:52Z","updated_at":"2016-07-24T23:03:59Z","closed_at":"2016-07-24T23:03:59Z","body":"Description of problem:\r\nA reflected DOM XSS vulnerability exists in the TinyMCE Insert/Edit Image window\r\n\r\nSteps to reproduce:\r\n1) Open the Insert/Edit Image window\r\n2) Click on the \"General\" tab\r\n3) Copy and paste the following into the \"Image URL\" field: \">&ltg;img src=x onerror=prompt(1);>\r\n5) Press tab to change focus to another field (the Javascript prompt should fire at this time)\r\n\r\nExpected result:\r\nNo popup / no javascript execution\r\n\r\nActual result:\r\nA popup / javascript execution\n> _**Legacy information imported from TinyMCE bug tracker:**_\n>\n> _[#T5856](http://archive.tinymce.com/develop/bugtracker_view.php?id=5856) posted by [grosser](http://archive.tinymce.com/profile.php?name=grosser)_\n\n> _**Tags:** [firefox msie safari chrome opera]_\n> _**Status:** Open_\n> _**Resolution:** None_\n> _**Attached URL:** none_\n"}}
{"actor":{"display_login":"blackcathikari"}}