{"id":"CVE-2024-38356","aliases":["GHSA-9hcv-j9pv-qmph","PYSEC-2026-1301"],"title":"TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option","summary":"TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","vendor":"tinymce","product":"tinymce","ecosystem":"npm","affected":["tinymce < 5.11.0","TinyMCE < 5.11.0","tinymce/tinymce < 5.11.0","tinymce >= 6.0.0, < 6.8.4","tinymce >= 7.0.0, < 7.2.0","TinyMCE >= 6.0.0, < 6.8.4","TinyMCE >= 7.0.0, < 7.2.0","tinymce/tinymce >= 6.0.0, < 6.8.4","tinymce/tinymce >= 7.0.0, < 7.2.0","django-tinymce < 4.1.0"],"patched":["tinymce 5.11.0","TinyMCE 5.11.0","tinymce/tinymce 5.11.0","tinymce 6.8.4","tinymce 7.2.0","TinyMCE 6.8.4","TinyMCE 7.2.0","tinymce/tinymce 6.8.4","tinymce/tinymce 7.2.0","django-tinymce 4.1.0"],"published":"2024-06-19","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:16.204200468Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9hcv-j9pv-qmph","references":[{"url":"https://github.com/tinymce/tinymce/security/advisories/GHSA-9hcv-j9pv-qmph"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38356"},{"url":"https://github.com/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d"},{"url":"https://github.com/tinymce/tinymce/commit/a9fb858509f86dacfa8b01cfd34653b408983ac0"},{"url":"https://github.com/tinymce/tinymce"},{"url":"https://owasp.org/www-community/attacks/xss"},{"url":"https://www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/#overview"},{"url":"https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview"},{"url":"https://www.tiny.cloud/docs/tinymce/latest/7.2-release-notes/#overview"}],"tags":["osv","npm"],"epss":0.00529,"epssPercentile":0.43711,"ingestedAt":"2026-07-08T18:25:48.014Z","slug":"CVE-2024-38356","body":"## Overview\n\n### Impact\nA [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) vulnerability was discovered in TinyMCE’s content extraction code. When using the `noneditable_regexp` option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the `noneditable_regexp` option, any content within an attribute is properly verified to match the configured regular expression before being added.\n\n### Fix\nTo avoid this vulnerability:\n\n* Upgrade to TinyMCE 7.2.0 or higher.\n* Upgrade to TinyMCE 6.8.4 or higher for TinyMCE 6.x.\n* Upgrade to TinyMCE 5.11.0 LTS or higher for TinyMCE 5.x (only available as part of commercial [long-term support](https://www.tiny.cloud/long-term-support/) contract).\n\n### References\n* [TinyMCE 6.8.4](https://www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/#overview)\n* [TinyMCE 7.2.0](https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview)\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)\n* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc)\n\n## Affected packages\n\n- `tinymce < 5.11.0`\n- `TinyMCE < 5.11.0`\n- `tinymce/tinymce < 5.11.0`\n- `tinymce >= 6.0.0, < 6.8.4`\n- `tinymce >= 7.0.0, < 7.2.0`\n- `TinyMCE >= 6.0.0, < 6.8.4`\n- `TinyMCE >= 7.0.0, < 7.2.0`\n- `tinymce/tinymce >= 6.0.0, < 6.8.4`\n- `tinymce/tinymce >= 7.0.0, < 7.2.0`\n- `django-tinymce < 4.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `tinymce 5.11.0`\n- `TinyMCE 5.11.0`\n- `tinymce/tinymce 5.11.0`\n- `tinymce 6.8.4`\n- `tinymce 7.2.0`\n- `TinyMCE 6.8.4`\n- `TinyMCE 7.2.0`\n- `tinymce/tinymce 6.8.4`\n- `tinymce/tinymce 7.2.0`\n- `django-tinymce 4.1.0`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}