TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements (CVE-2024-38357)

Why this deserves its current priority

CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps tinymce (npm), tinymce (npm), tinymce (npm), TinyMCE (nuget) and additional mapped packages. Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
tinymcenpm	>=0 <5.11.0	5.11.0
tinymcenpm	>=6.0.0 <6.8.4	6.8.4
tinymcenpm	>=7.0.0 <7.2.0	7.2.0
TinyMCEnuget	>=0 <5.11.0	5.11.0
TinyMCEnuget	>=6.0.0 <6.8.4	6.8.4
TinyMCEnuget	>=7.0.0 <7.2.0	7.2.0
tinymce/tinymcepackagist	>=0 <5.11.0	5.11.0
tinymce/tinymcepackagist	>=6.0.0 <6.8.4	6.8.4
tinymce/tinymcepackagist	>=7.0.0 <7.2.0	7.2.0
django-tinymcepypi	>=0 <4.1.0	4.1.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for tinymce, tinymce, tinymce.
Review the reported fix. Update tinymce to 5.11.0; tinymce to 6.8.4; tinymce to 7.2.0; TinyMCE to 5.11.0; TinyMCE to 6.8.4; TinyMCE to 7.2.0; tinymce/tinymce to 5.11.0; tinymce/tinymce to 6.8.4; tinymce/tinymce to 7.2.0; django-tinymce to 4.1.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jun 19, 2024
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Aug 8, 2026

Sources and claim methodology

Upstream source description

### Impact A [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. ### Patches This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. ### Fix To avoid this vulnerability: * Upgrade to TinyMCE 7.2.0 or higher. * Upgrade to TinyMCE 6.8.4 or higher for TinyMCE 6.x. * Upgrade to TinyMCE 5.11.0 LTS or higher for TinyMCE 5.x (only available as part of commercial [long-term support](https://www.tiny.cloud/long-term-support/) contract). ### Acknowledgements Tiny thanks [Malav Khatri](https://malavkhatri.com/) and another reporter for their help identifying this vulnerability. ### References * [TinyMCE 6.8.4](https://www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/#overview) * [TinyMCE 7.2.0](https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview) ### For more information If you have any questions or comments about this advisory: * Email us at [[email protected]](mailto:[email protected]) * Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc)

Quoted source text, attributed separately from HOL analysis.