# CVE-2024-38356: PYSEC-2026-1301 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

Source: https://junglewise.ai/threats/cve-2024-38356-tinymce-cross-site-scripting-in-noneditable-regexp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-38356 · Severity: low · CVSS 3.1 · Published 2026-07-07

TinyMCE is a popular rich-text editor used in websites and applications to allow users to create and format content. An attacker can inject malicious code through specially crafted HTML attributes when the noneditable_regexp option is enabled, allowing the code to execute when content is extracted from the editor. This could lead to account compromise, session hijacking, or unauthorized actions performed on behalf of the user.

Technologies: [tinymce (npm)](https://junglewise.ai/threats/technologies/tinymce), [TinyMCE (NuGet)](https://junglewise.ai/threats/technologies/nuget-tinymce), [tinymce/tinymce (Packagist)](https://junglewise.ai/threats/technologies/tinymce-tinymce), [django-tinymce (PyPI)](https://junglewise.ai/threats/technologies/django-tinymce). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [NuGet](https://junglewise.ai/threats/vendors/nuget), [Packagist](https://junglewise.ai/threats/vendors/packagist), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-38356 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-38356 being exploited in the wild.

**How severe is CVE-2024-38356?** Low severity, with a CVSS score of 3.1, published 7 July 2026.

**Which products and versions are affected?** tinymce (npm) SEMVER:introduced=0,fixed=5.11.0; TinyMCE (NuGet) ECOSYSTEM:introduced=0,fixed=5.11.0; tinymce/tinymce (Packagist) ECOSYSTEM:introduced=0,fixed=5.11.0; django-tinymce (PyPI) ECOSYSTEM:introduced=0,fixed=4.1.0.

**Is there a fix for CVE-2024-38356?** Yes. tinymce (npm): upgrade to 5.11.0 or later; TinyMCE (NuGet): upgrade to 5.11.0 or later; tinymce/tinymce (Packagist): upgrade to 5.11.0 or later; django-tinymce (PyPI): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-38356 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-38356?** Check whether you run tinymce (npm), TinyMCE (NuGet), tinymce/tinymce (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tinymce (npm): upgrade to 5.11.0 or later

  ```sh
  npm install tinymce@5.11.0
  ```

- TinyMCE (NuGet): upgrade to 5.11.0 or later

  ```sh
  dotnet add package TinyMCE --version 5.11.0
  ```

- tinymce/tinymce (Packagist): upgrade to 5.11.0 or later

  ```sh
  composer require tinymce/tinymce:^5.11.0
  ```

- django-tinymce (PyPI): upgrade to 4.1.0 or later

  ```sh
  pip install "django-tinymce>=4.1.0"
  ```


## Technical details

This is a cross-site scripting (XSS) vulnerability (CWE-79) in TinyMCE's content extraction code when the noneditable_regexp option is configured. The vulnerability exists because the editor fails to properly validate that HTML attribute content matches the configured regular expression before processing it, allowing malicious payloads to bypass sanitization. Attack requires network access and user interaction (a user must extract content from the editor containing the malicious payload). An attacker can execute arbitrary JavaScript in the context of the affected user's session. The vulnerability has been patched in TinyMCE 7.2.0, 6.8.4, and 5.11.0 LTS by adding proper attribute validation against the configured regular expression.

## Affected products

- Tiny TinyMCE <5.11.0, 6.0.0-6.8.3, 7.0.0-7.1.2
- Tiny TinyMCE 5.x before 5.11.0 LTS

## Identifiers

- CVE-2024-38356
- GHSA-9hcv-j9pv-qmph
- PYSEC-2026-1301

## Timeline

- 2024-06-19: disclosed: Vulnerability published
- 2024-06-19: patched: TinyMCE 7.2.0, 6.8.4, and 5.11.0 LTS patched

## References

- [https://github.com/tinymce/tinymce/security/advisories/GHSA-9hcv-j9pv-qmph](https://github.com/tinymce/tinymce/security/advisories/GHSA-9hcv-j9pv-qmph)

## Related threats

- [TinyMCE media plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116675-tinymce-is-an-open-source-rich-text-editor-from-7-9-3-until-7-9)
- [PYSEC-2026-1302 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements](https://junglewise.ai/threats/cve-2024-38357-tinymce-cross-site-scripting-in-noscript-element-parsing)
- [PYSEC-2026-632 - Cross-site scripting vulnerability in TinyMCE plugins](https://junglewise.ai/threats/cve-2024-21910-tinymce-cross-site-scripting-in-image-and-link-plugins)
- [Tiny Technologies TinyMCE stored XSS via forged mce:protected comments](https://junglewise.ai/threats/cve-2026-47762-tiny-technologies-tinymce-stored-xss-via-forged-mce-protected)
- [Tiny Technologies TinyMCE stored XSS in media plugin](https://junglewise.ai/threats/cve-2026-47761-tiny-technologies-tinymce-stored-xss-in-media-plugin)