CVE-2024-38356

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-38356
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38356.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-38356
Aliases
Downstream
Published
2024-06-19T20:03:47.923Z
Modified
2026-04-10T05:15:45.076456Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Details

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditable_regexp option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the noneditable_regexp option, any content within an attribute is properly verified to match the configured regular expression before being added. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38356.json"
}
References

Affected packages

Git / github.com/tinymce/tinymce

Affected ranges

Type
GIT
Repo
https://github.com/tinymce/tinymce
Events
Introduced
4cc623897917472ba418f1378170727d7a94575b
Fixed
8a7b799033af4058818ea17e27ad36c58e2402f9
Database specific 
{
    "versions": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.8.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/tinymce/tinymce
Events
Introduced
38b36acdf3610b8116014570b7a065710730db90
Fixed
8ca0674d43fff53fd166d254fafab2c814586c8f
Database specific 
{
    "versions": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.2.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38356.json"