CVE-2024-38357: TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Impact A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor.
Patches This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed.
Fix To avoid this vulnerability:
Upgrade to TinyMCE 7.2.0 or higher. Upgrade to TinyMCE 6.8.4 or higher for TinyMCE 6.x. Upgrade to TinyMCE 5.11.0 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract).
Acknowledgements Tiny thanks Malav Khatri and another reporter for their help identifying this vulnerability.
References TinyMCE 6.8.4 TinyMCE 7.2.0
For more information If you have any questions or comments about this advisory:
Email us at infosec@tiny.cloud Open an issue in the TinyMCE repo
Other sources
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38357?
CVE-2024-38357 is categorized as a cross-site scripting (XSS) vulnerability, which can lead to the execution of malicious scripts in a user's browser.
How do I fix CVE-2024-38357?
To fix CVE-2024-38357, upgrade your TinyMCE package to version 7.2.0 or 6.8.4, depending on your current version.
Which versions of TinyMCE are affected by CVE-2024-38357?
CVE-2024-38357 affects TinyMCE versions from 6.0.0 up to 6.8.4 and from 7.0.0 up to 7.2.0.
What kind of attacks can exploit CVE-2024-38357?
CVE-2024-38357 can be exploited through cross-site scripting attacks, allowing attackers to inject malicious scripts into web pages.
Is my application safe if I am using a version lower than 5.11.0 of TinyMCE?
Applications using TinyMCE versions lower than 5.11.0 are not affected by CVE-2024-38357 but should still be reviewed for other vulnerabilities.