Log in Start free

Vulnerability · Published Jun 19, 2024 · Assigned by GitHub_M

CVE-2024-38357TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

Medium 6.1

In plain English

A medium-severity cross-site scripting in tinymce from tinymce. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.5%top 55.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
NuGettinymce7.2.0GHSA-w9jx-4g6g-rp7x
NuGettinymce5.11.0GHSA-w9jx-4g6g-rp7x
NuGettinymce6.8.4GHSA-w9jx-4g6g-rp7x
Packagisttinymce/tinymce6.8.4GHSA-w9jx-4g6g-rp7x
Packagisttinymce/tinymce5.11.0GHSA-w9jx-4g6g-rp7x
Packagisttinymce/tinymce7.2.0GHSA-w9jx-4g6g-rp7x
PyPIdjango-tinymce4.1.0PYSEC-2026-1302
PyPIdjango-tinymce4.1.0GHSA-w9jx-4g6g-rp7x
Ubuntu:25.10roundcubeno fix listedUBUNTU-CVE-2024-38357
Ubuntu:26.10roundcubeno fix listedUBUNTU-CVE-2024-38357
npmtinymce7.2.0GHSA-w9jx-4g6g-rp7x
npmtinymce6.8.4GHSA-w9jx-4g6g-rp7x
npmtinymce5.11.0GHSA-w9jx-4g6g-rp7x

Affected products (as reported)

VendorProductVersions
tinymce tinymce < 5.11.0>= 6.0.0, <6.8.4>= 7.0.0, < 7.2.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References