---
id: CVE-2024-38356
aliases:
  - GHSA-9hcv-j9pv-qmph
  - PYSEC-2026-1301
title: >-
  TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp
  option
summary: >-
  TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp
  option
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: tinymce
product: tinymce
ecosystem: npm
affected:
  - tinymce < 5.11.0
  - TinyMCE < 5.11.0
  - tinymce/tinymce < 5.11.0
  - 'tinymce >= 6.0.0, < 6.8.4'
  - 'tinymce >= 7.0.0, < 7.2.0'
  - 'TinyMCE >= 6.0.0, < 6.8.4'
  - 'TinyMCE >= 7.0.0, < 7.2.0'
  - 'tinymce/tinymce >= 6.0.0, < 6.8.4'
  - 'tinymce/tinymce >= 7.0.0, < 7.2.0'
  - django-tinymce < 4.1.0
patched:
  - tinymce 5.11.0
  - TinyMCE 5.11.0
  - tinymce/tinymce 5.11.0
  - tinymce 6.8.4
  - tinymce 7.2.0
  - TinyMCE 6.8.4
  - TinyMCE 7.2.0
  - tinymce/tinymce 6.8.4
  - tinymce/tinymce 7.2.0
  - django-tinymce 4.1.0
published: '2024-06-19'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:16.204200468Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9hcv-j9pv-qmph'
references:
  - url: 'https://github.com/tinymce/tinymce/security/advisories/GHSA-9hcv-j9pv-qmph'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-38356'
  - url: >-
      https://github.com/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d
  - url: >-
      https://github.com/tinymce/tinymce/commit/a9fb858509f86dacfa8b01cfd34653b408983ac0
  - url: 'https://github.com/tinymce/tinymce'
  - url: 'https://owasp.org/www-community/attacks/xss'
  - url: 'https://www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/#overview'
  - url: 'https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview'
  - url: 'https://www.tiny.cloud/docs/tinymce/latest/7.2-release-notes/#overview'
tags:
  - osv
  - npm
epss: 0.00529
epssPercentile: 0.42258
ingestedAt: '2026-07-08T18:25:48.014Z'
---

## Overview

### Impact
A [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) vulnerability was discovered in TinyMCE’s content extraction code. When using the `noneditable_regexp` option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor.

### Patches
This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the `noneditable_regexp` option, any content within an attribute is properly verified to match the configured regular expression before being added.

### Fix
To avoid this vulnerability:

* Upgrade to TinyMCE 7.2.0 or higher.
* Upgrade to TinyMCE 6.8.4 or higher for TinyMCE 6.x.
* Upgrade to TinyMCE 5.11.0 LTS or higher for TinyMCE 5.x (only available as part of commercial [long-term support](https://www.tiny.cloud/long-term-support/) contract).

### References
* [TinyMCE 6.8.4](https://www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/#overview)
* [TinyMCE 7.2.0](https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview)

### For more information
If you have any questions or comments about this advisory:

* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc)

## Affected packages

- `tinymce < 5.11.0`
- `TinyMCE < 5.11.0`
- `tinymce/tinymce < 5.11.0`
- `tinymce >= 6.0.0, < 6.8.4`
- `tinymce >= 7.0.0, < 7.2.0`
- `TinyMCE >= 6.0.0, < 6.8.4`
- `TinyMCE >= 7.0.0, < 7.2.0`
- `tinymce/tinymce >= 6.0.0, < 6.8.4`
- `tinymce/tinymce >= 7.0.0, < 7.2.0`
- `django-tinymce < 4.1.0`

## Remediation

Upgrade to a patched release:

- `tinymce 5.11.0`
- `TinyMCE 5.11.0`
- `tinymce/tinymce 5.11.0`
- `tinymce 6.8.4`
- `tinymce 7.2.0`
- `TinyMCE 6.8.4`
- `TinyMCE 7.2.0`
- `tinymce/tinymce 6.8.4`
- `tinymce/tinymce 7.2.0`
- `django-tinymce 4.1.0`