CVE-2024-38356: TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Impact A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditableregexp option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor.
Patches This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the noneditableregexp option, any content within an attribute is properly verified to match the configured regular expression before being added.
Fix To avoid this vulnerability:
Upgrade to TinyMCE 7.2.0 or higher. Upgrade to TinyMCE 6.8.4 or higher for TinyMCE 6.x. Upgrade to TinyMCE 5.11.0 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract).
References TinyMCE 6.8.4 TinyMCE 7.2.0
For more information If you have any questions or comments about this advisory:
Email us at infosec@tiny.cloud Open an issue in the TinyMCE repo
Other sources
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditableregexp option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the noneditableregexp option, any content within an attribute is properly verified to match the configured regular expression before being added. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38356?
CVE-2024-38356 is classified as a cross-site scripting (XSS) vulnerability which can potentially allow attackers to execute malicious scripts.
How do I fix CVE-2024-38356?
To fix CVE-2024-38356, upgrade TinyMCE to version 7.2.0, 6.8.4, or the corresponding remedied versions as specified for your package source.
Which versions of TinyMCE are affected by CVE-2024-38356?
CVE-2024-38356 affects TinyMCE versions between 6.0.0 and 6.8.4, and between 7.0.0 and 7.2.0, as well as versions prior to 5.11.0.
What is the impact of CVE-2024-38356?
The impact of CVE-2024-38356 is that it allows the execution of malicious scripts found in crafted HTML attributes when the noneditable_regexp option is used.
Is CVE-2024-38356 specific to certain package sources?
Yes, CVE-2024-38356 affects TinyMCE packages sourced from composer, npm, nuget, and pip.