CVE-2024-38356: PYSEC-2026-1301 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

CVE-2024-38356 · Severity: low · CVSS 3.1 · Published 2026-07-07

TinyMCE is a popular rich-text editor used in websites and applications to allow users to create and format content. An attacker can inject malicious code through specially crafted HTML attributes when the noneditable_regexp option is enabled, allowing the code to execute when content is extracted from the editor. This could lead to account compromise, session hijacking, or unauthorized actions performed on behalf of the user.

Technologies: tinymce (npm), TinyMCE (NuGet), tinymce/tinymce (Packagist), django-tinymce (PyPI). Vendors: npm, NuGet, Packagist, PyPI.

Quick answers

Is CVE-2024-38356 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-38356 being exploited in the wild.
How severe is CVE-2024-38356?
Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?
tinymce (npm) SEMVER:introduced=0,fixed=5.11.0; TinyMCE (NuGet) ECOSYSTEM:introduced=0,fixed=5.11.0; tinymce/tinymce (Packagist) ECOSYSTEM:introduced=0,fixed=5.11.0; django-tinymce (PyPI) ECOSYSTEM:introduced=0,fixed=4.1.0.
Is there a fix for CVE-2024-38356?
Yes. tinymce (npm): upgrade to 5.11.0 or later; TinyMCE (NuGet): upgrade to 5.11.0 or later; tinymce/tinymce (Packagist): upgrade to 5.11.0 or later; django-tinymce (PyPI): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-38356 attacked?
It is attacked over the network.
Am I affected by CVE-2024-38356?
Check whether you run tinymce (npm), TinyMCE (NuGet), tinymce/tinymce (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tinymce (npm): upgrade to 5.11.0 or later
    npm install tinymce@5.11.0
  • TinyMCE (NuGet): upgrade to 5.11.0 or later
    dotnet add package TinyMCE --version 5.11.0
  • tinymce/tinymce (Packagist): upgrade to 5.11.0 or later
    composer require tinymce/tinymce:^5.11.0
  • django-tinymce (PyPI): upgrade to 4.1.0 or later
    pip install "django-tinymce>=4.1.0"

Technical details

This is a cross-site scripting (XSS) vulnerability (CWE-79) in TinyMCE's content extraction code when the noneditable_regexp option is configured. The vulnerability exists because the editor fails to properly validate that HTML attribute content matches the configured regular expression before processing it, allowing malicious payloads to bypass sanitization. Attack requires network access and user interaction (a user must extract content from the editor containing the malicious payload). An attacker can execute arbitrary JavaScript in the context of the affected user's session. The vulnerability has been patched in TinyMCE 7.2.0, 6.8.4, and 5.11.0 LTS by adding proper attribute validation against the configured regular expression.

Affected products

  • Tiny TinyMCE <5.11.0, 6.0.0-6.8.3, 7.0.0-7.1.2
  • Tiny TinyMCE 5.x before 5.11.0 LTS

Identifiers

  • CVE-2024-38356
  • GHSA-9hcv-j9pv-qmph
  • PYSEC-2026-1301

Timeline

  • 2024-06-19: disclosed: Vulnerability published
  • 2024-06-19: patched: TinyMCE 7.2.0, 6.8.4, and 5.11.0 LTS patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.