Is CVE-2024-29203 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-29203 being exploited in the wild.

How severe is CVE-2024-29203?

Low severity, with a CVSS score of 3.1, published 26 March 2024.

Which products and versions are affected?

tinymce (npm) SEMVER:introduced=0,fixed=6.8.1.

Is there a fix for CVE-2024-29203?

Yes. tinymce (npm): upgrade to 6.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-29203 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-29203?

Check whether you run tinymce (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-29203: TinyMCE cross-site scripting in iframe handling

CVE-2024-29203 · Severity: low · CVSS 3.1 · Published 2024-03-26

TinyMCE is a JavaScript rich-text editor used in content management systems and web applications. A cross-site scripting (XSS) vulnerability in iframe handling allowed attackers to inject malicious code into editors, potentially leading to data theft, credential harvesting, or malware distribution to end users viewing the compromised content.

Technologies: tinymce (npm). Vendors: npm.

Quick answers

Is CVE-2024-29203 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-29203 being exploited in the wild.
How severe is CVE-2024-29203?: Low severity, with a CVSS score of 3.1, published 26 March 2024.
Which products and versions are affected?: tinymce (npm) SEMVER:introduced=0,fixed=6.8.1.
Is there a fix for CVE-2024-29203?: Yes. tinymce (npm): upgrade to 6.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-29203 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-29203?: Check whether you run tinymce (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tinymce (npm): upgrade to 6.8.1 or later
```
npm install tinymce@6.8.1
```

Technical details

A cross-site scripting (XSS) vulnerability exists in TinyMCE's content insertion code that fails to properly sanitize iframe elements containing malicious scripts. When an attacker inserts an iframe with embedded JavaScript into the editor, the code executes within the editor's context. Although iframe permissions are partially restricted by browser same-origin policy, execution can still trigger dangerous operations such as downloading malicious assets, exfiltrating clipboard data, or accessing DOM content. The vulnerability requires user interaction (inserting content into the editor). The fix introduces a sandbox_iframes boolean option (enabled by default in TinyMCE 7.0.0) that adds the sandbox="" attribute to all iframe elements, preventing cross-origin and same-origin XSS. TinyMCE 7.0.0 also introduced sandbox_iframes_exclusions to allow selective exclusion of trusted domains from sandboxing.

Affected products

TinyMCE TinyMCE <6.8.1 (npm), <7.0.0 (complete fix with default enabled)
TinyMCE TinyMCE (NuGet) <7.0.0
TinyMCE TinyMCE (Composer) <7.0.0

Identifiers

CVE-2024-29203
GHSA-438c-3975-5x3f

Timeline

2024-03-26: disclosed: Vulnerability advisory GHSA-438c-3975-5x3f published
2023-11-21: patched: Fix committed as part of TinyMCE 6.8.1 with sandbox_iframes option (disabled by default)
2024: patched: TinyMCE 7.0.0 released with sandbox_iframes enabled by default

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.