DOC-2457: TinyMCE 7.2 Security Patch. (#3360)

* DOC-2457: TinyMCE 7.2 Security Patch.

* Update modules/ROOT/pages/7.2-release-notes.adoc

* Update modules/ROOT/pages/7.2-release-notes.adoc

Co-authored-by: shirqa <[email protected]>

---------

Co-authored-by: shirqa <[email protected]>

Author: kemister85

modules/ROOT/nav.adoc

@@ -413,6 +413,7 @@
 **** xref:7.2-release-notes.adoc#additions[Additions]
 **** xref:7.2-release-notes.adoc#changes[Changes]
 **** xref:7.2-release-notes.adoc#bug-fixes[Bug fixes]
+**** xref:7.2-release-notes.adoc#security-fixes[Security fixes]
 *** {productname} 7.1.2
 **** xref:7.1.2-release-notes.adoc#overview[Overview]
 **** xref:7.1.2-release-notes.adoc#accompanying-premium-plugin-changes[Accompanying Premium Plugin changes]

modules/ROOT/pages/7.2-release-notes.adoc

@@ -19,6 +19,7 @@ include::partial$misc/admon-releasenotes-for-stable.adoc[]
 * xref:additions[Additions]
 * xref:changes[Changes]
 * xref:bug-fixes[Bug fixes]
+* xref:security-fixes[Security fixes]
 
 
 [[accompanying-premium-self-hosted-server-side-component-changes]]
@@ -353,4 +354,33 @@ Previously in {productname}, the `role` attribute on listbox dialog components w
 
 In {productname} {release-version}, this issue has been addressed by setting the `role` attribute to `combobox` when there are no nested menu items.
 
-As a result, screen readers now announce the listbox as a combobox and the menu it opens as a listbox. This improvement ensures that the currently selected value is announced when tabbing to the select box, and the selected items are announced as a listbox.
+As a result, screen readers now announce the listbox as a combobox and the menu it opens as a listbox. This improvement ensures that the currently selected value is announced when tabbing to the select box, and the selected items are announced as a listbox.
+
+[[security-fixes]]
+== Security fixes
+
+{productname} {release-version} includes two fixes for the following security issues:
+
+=== HTML entities that were double decoded in `noscript` elements caused an XSS vulnerability.
+// #TINY-11019
+
+A https://owasp.org/www-community/attacks/xss/[cross-site scripting] (XSS) vulnerability was discovered in {productname}'s content parsing code. This allowed specially crafted `noscript` elements containing malicious code to be executed when that content was loaded into the editor.
+
+This vulnerability has been patched in {productname} {release-version}, {productname} 6.8.4 and {productname} 5.11.0 LTS by ensuring that content within `noscript` elements are properly parsed.
+
+GHSA: link:https://github.com/tinymce/tinymce/security/advisories/GHSA-w9jx-4g6g-rp7x[GitHub Advisory].
+
+CVE: Pending.
+
+NOTE: Tiny Technologies would like to thank link:https://malavkhatri.com/[Malav Khatri (devilbugbounty)] and another reporter for discovering this vulnerability.
+
+=== It was possible to inject XSS HTML that was not matching the regexp when using the `noneditable_regexp` option.
+// #TINY-11022
+
+A https://owasp.org/www-community/attacks/xss/[cross-site scripting] (XSS) vulnerability was discovered in {productname}'s content extraction code. When using the `noneditable_regexp` option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor.
+
+This vulnerability has been patched in {productname} {release-version}, {productname} 6.8.4 and {productname} 5.11.0 LTS by ensuring that, when using the `noneditable_regexp` option, any content within an attribute is properly verified to match the configured regular expression before being added.
+
+GHSA: link:https://github.com/tinymce/tinymce/security/advisories/GHSA-9hcv-j9pv-qmph[GitHub Advisory].
+
+CVE: Pending.

modules/ROOT/pages/changelog.adoc

@@ -43,6 +43,11 @@ NOTE: This is the {productname} Community version changelog. For information abo
 // #TINY-10820
 * Corrected the `role` attribute on listbox dialog components to `combobox` when there are no nested menu items.
 // #TINY-10807
+* HTML entities that were double decoded in `noscript` elements caused an XSS vulnerability.
+// #TINY-11019
+* It was possible to inject XSS HTML that was not matching the regexp when using the `noneditable_regexp` option.
+// #TINY-11022
+
 
 == 7.1.2 - 2024-06-05