CVE-2024-38357

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-38357
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38357.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-38357
Aliases
Downstream
Published
2024-06-19T20:03:49.806Z
Modified
2026-04-10T05:15:45.073865Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Details

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38357.json",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/tinymce/tinymce

Affected ranges

Type
GIT
Repo
https://github.com/tinymce/tinymce
Events
Introduced
4cc623897917472ba418f1378170727d7a94575b
Fixed
8a7b799033af4058818ea17e27ad36c58e2402f9
Database specific 
{
    "versions": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.8.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/tinymce/tinymce
Events
Introduced
38b36acdf3610b8116014570b7a065710730db90
Fixed
8ca0674d43fff53fd166d254fafab2c814586c8f
Database specific 
{
    "versions": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.2.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38357.json"