PT-2021-24350 · Tinymce · Tinymce

William Bowling

·

Published

2021-10-22

·

Updated

2025-11-28

·

CVE-2024-21908

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: TinyMCE versions prior to 5.9.0
Description: A stored cross-site scripting vulnerability affects TinyMCE, allowing an unauthenticated and remote attacker to insert crafted HTML into the editor. This results in arbitrary JavaScript execution in another user's browser. The vulnerability is due to a flaw in the schema validation logic of the core parser, which can be exploited when inserting specially crafted content into the editor using the clipboard or editor APIs.
Recommendations: To resolve the issue, upgrade to TinyMCE 5.9.0 or higher. Alternatively, manually sanitize the content using the BeforeSetContent event. For example, use the following code to sanitize content:
editor.on('BeforeSetContent', function(e) {
 var sanitizedContent = ...; // Manually sanitize content here
 e.content = sanitizedContent;
});

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-21908
GHSA-5H9G-X5RV-25WG
GHSA-GJHC-6XM7-MC8Q

Affected Products

Tinymce