PT-2021-24352 · Tinymce · Tinymce

Aaron Bishop · Published 2021-01-06 · Updated 2025-06-11 · CVE-2024-21911

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: TinyMCE versions prior to 5.6.0

Description: A stored cross-site scripting vulnerability was discovered in the URL sanitization logic of the core parser, allowing arbitrary JavaScript execution when inserting specially crafted content into the editor. This impacts all users using TinyMCE 5.5.1 or lower. An unauthenticated and remote attacker could insert crafted HTML into the editor, resulting in arbitrary JavaScript execution in another user's browser.

Recommendations: To resolve the issue, upgrade to TinyMCE 5.6.0 or higher. As a temporary workaround, manually sanitize iframe, object, and embed URL attributes using a TinyMCE node filter. Alternatively, disable iframe, object, and embed elements in your content using the invalid elements setting.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-21911

GHSA-Q5PP-5Q2H-G8RV

GHSA-W7JX-J77M-WP65

Affected Products

Tinymce

References · 18

• 🔥 https://github.com/tinymce/tinymce/security/advisories/GHSA-w7jx-j77m-wp65 · Exploit
• 🔥 https://github.com/advisories/GHSA-w7jx-j77m-wp65 · Exploit
• https://osv.dev/vulnerability/CVE-2024-21911 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21911 · Security Note
• https://ubuntu.com/security/CVE-2024-21911 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q5pp-5q2h-g8rv · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-21911 · Security Note
• https://osv.dev/vulnerability/GHSA-w7jx-j77m-wp65 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-21911 · Vendor Advisory
• https://t.me/cvenotify/66669 · Telegram Post
• https://npmjs.com/package/tinymce · Note
• https://vulncheck.com/advisories/vc-advisory-GHSA-w7jx-j77m-wp65 · Note
• https://t.me/cvenotify/66084 · Telegram Post
• https://tiny.cloud/docs/release-notes/release-notes56/#securityfixes · Note
• https://twitter.com/CVEnew/status/1742581605749883148 · Twitter Post