Cross-Site Scripting Vulnerability in TinyMCE Rich Text Editor
CVE-2024-38356
What is CVE-2024-38356?
TinyMCE, the popular open source rich text editor, has encountered a cross-site scripting (XSS) vulnerability within its content extraction functionality. This vulnerability arises when utilizing the noneditable_regexp option, where specially crafted HTML attributes can execute malicious code during content extraction. The issue has been addressed in significant updates, including TinyMCE versions 7.2.0, 6.8.4, and 5.11.0 LTS. These updates ensure that content within an attribute is validated against the configured regular expression before being processed, effectively mitigating the risk of code execution. Users are urged to upgrade their TinyMCE installations to these patched versions urgently, as there are currently no workarounds available.
Affected Version(s)
tinymce < 5.11.0 < 5.11.0
tinymce >= 6.0.0, <6.8.4 < 6.0.0, 6.8.4
tinymce >= 7.0.0, < 7.2.0 < 7.0.0, 7.2.0