PT-2024-23105 · Tinymce · Tinymce

Toni Huttunen · Published 2024-03-26 · Updated 2026-03-19 · CVE-2024-29881

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE versions prior to 6.8.1 TinyMCE versions prior to 7.0.0

Description A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or embed element and that image could potentially contain a XSS payload.

Recommendations For versions prior to 6.8.1, a custom NodeFilter is recommended to remove or modify any object or embed elements. This can be added using the editor.parser.addNodeFilter and editor.serializer.addNodeFilter APIs. For versions 6.8.1 and higher, set convert unsafe embeds to true. For any earlier versions, consider temporarily disabling the use of object and embed elements until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-29881

GHSA-5359-PVF2-PW78

Affected Products

Tinymce

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29881.json · Exploit
• https://github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1 · Patch
• https://github.com/tinymce/tinymce/security/advisories/GHSA-5359-pvf2-pw78 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-29881 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29881 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29881 · Security Note
• https://osv.dev/vulnerability/GHSA-5359-pvf2-pw78 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-29881 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-29881 · Vendor Advisory
• https://github.com/tinymce/tinymce · Note
• https://t.me/cveNotify/134078 · Telegram Post
• https://t.me/cvenotify/74697 · Telegram Post
• https://tiny.cloud/docs/tinymce/7/7.0-release-notes/#convert_unsafe_embeds-editor-option-is-now-defaulted-to-true · Note
• https://twitter.com/VulmonFeeds/status/1772664900973723811 · Twitter Post
• https://twitter.com/CVEnew/status/1772618960392872080 · Twitter Post