Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jazzband/django-tinymce

              master @ 051886b
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

Cross-Site Request Forgery (CSRF): 1 prior fix. Scrutinize any change in this area.

tinymce/static/tiny_mce/plugins/media/js/media.js: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Request Forgery (CSRF): The spell check view previously bypassed CSRF validation insecurely or crashed depending on the Django version compatibility wrapper around the csrf_exempt decorator. This could allow attackers to perform CSRF attacks against the spell checker endpoints if wrappers are misconfigured or fail silently.

Insecure Transport: Hardcoded HTTP protocols in media embed scripts (like Flash and iframe integration) can trigger mixed content warnings or allow active man-in-the-middle manipulation of framed content when the parent site is served over HTTPS.