Cross-Site Scripting Vulnerability in TinyMCE Rich Text Editor
CVE-2024-38357
6.1MEDIUM
What is CVE-2024-38357?
A cross-site scripting (XSS) vulnerability was identified in the content parsing code of TinyMCE, an open source rich text editor. This security flaw enables attackers to execute specially crafted noscript elements embedded with malicious scripts when the affected content is loaded into the editor. To mitigate this risk, patches have been released in TinyMCE versions 7.2.0, 6.8.4, and 5.11.0 LTS, which correct the parsing of content within noscript elements. Users are strongly encouraged to upgrade to the latest versions to ensure protection against this vulnerability as there are no known workarounds.
Affected Version(s)
tinymce < 5.11.0 < 5.11.0
tinymce >= 6.0.0, <6.8.4 < 6.0.0, 6.8.4
tinymce >= 7.0.0, < 7.2.0 < 7.0.0, 7.2.0