CVE-2024-38357 json
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
published 2024-06-19 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-2189 , GHSA-w9jx-4g6g-rp7x , PYSEC-2026-1302
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
- npm tinymce 5.11.0, 6.8.4, 7.2.0
- nuget TinyMCE 5.11.0, 6.8.4, 7.2.0
- packagist tinymce/tinymce 5.11.0, 6.8.4, 7.2.0
- pypi django-tinymce 4.1.0
- tiny tinymce 5.11.0, 6.8.4, 7.2.0
- roundcube Ubuntu Pro 22.04 LTS 1.5.0+dfsg.1-2ubuntu0.1~esm6
- roundcube Ubuntu Pro 24.04 LTS 1.6.6+dfsg-2ubuntu0.1+esm3
ubuntu advisories UBUNTU-CVE-2024-38357
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | tinymce | <5.11.0 >=6.0.0, <6.8.4 >=7.0.0, <7.2.0 |
5.11.0 6.8.4 7.2.0 |
| nuget | TinyMCE | <5.11.0 >=6.0.0, <6.8.4 >=7.0.0, <7.2.0 |
5.11.0 6.8.4 7.2.0 |
| packagist | tinymce/tinymce | <5.11.0 >=6.0.0, <6.8.4 >=7.0.0, <7.2.0 |
5.11.0 6.8.4 7.2.0 |
| pypi | django-tinymce | <4.1.0 |
4.1.0 |
Affected products
- tinymce tinymce
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d
web
-
github.com
/tinymce/tinymce/commit/a9fb858509f86dacfa8b01cfd34653b408983ac0
web
-
github.com
/tinymce/tinymce/security/advisories/GHSA-w9jx-4g6g-rp7x
web
-
owasp.org
/www-community/attacks/xss
web
-
tiny.cloud
/docs/tinymce/6/6.8.4-release-notes/#overview
web
-
tiny.cloud
/docs/tinymce/7/7.2-release-notes/#overview
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-38357
advisory
-
github.com
/tinymce/tinymce
package
-
pypi.org
/project/django-tinymce
package
-
github.com
/advisories/GHSA-w9jx-4g6g-rp7x
advisory
Sources
- CVE List CVE-2024-38357
- GitHub Advisory GHSA-w9jx-4g6g-rp7x
- NVD CVE-2024-38357
- OSV PYSEC-2026-1302
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.