CVE-2024-38357: PYSEC-2026-1302 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

CVE-2024-38357 · Severity: low · CVSS 3.1 · Published 2026-07-07

TinyMCE is a rich-text editor widely used in web applications and content management systems. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious code via specially crafted noscript elements that are executed when content is loaded into the editor, potentially compromising user data and sessions.

Technologies: tinymce (npm), TinyMCE (NuGet), tinymce/tinymce (Packagist), django-tinymce (PyPI). Vendors: npm, NuGet, Packagist, PyPI.

Quick answers

Is CVE-2024-38357 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-38357 being exploited in the wild.
How severe is CVE-2024-38357?
Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?
tinymce (npm) SEMVER:introduced=0,fixed=5.11.0; TinyMCE (NuGet) ECOSYSTEM:introduced=0,fixed=5.11.0; tinymce/tinymce (Packagist) ECOSYSTEM:introduced=0,fixed=5.11.0; django-tinymce (PyPI) ECOSYSTEM:introduced=0,fixed=4.1.0.
Is there a fix for CVE-2024-38357?
Yes. tinymce (npm): upgrade to 5.11.0 or later; TinyMCE (NuGet): upgrade to 5.11.0 or later; tinymce/tinymce (Packagist): upgrade to 5.11.0 or later; django-tinymce (PyPI): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-38357 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-38357?
Check whether you run tinymce (npm), TinyMCE (NuGet), tinymce/tinymce (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tinymce (npm): upgrade to 5.11.0 or later
    npm install tinymce@5.11.0
  • TinyMCE (NuGet): upgrade to 5.11.0 or later
    dotnet add package TinyMCE --version 5.11.0
  • tinymce/tinymce (Packagist): upgrade to 5.11.0 or later
    composer require tinymce/tinymce:^5.11.0
  • django-tinymce (PyPI): upgrade to 4.1.0 or later
    pip install "django-tinymce>=4.1.0"

Technical details

This is a cross-site scripting (CWE-79) vulnerability in TinyMCE's content parsing code. The root cause is improper handling of noscript HTML elements during content parsing, which allows malicious code embedded within noscript tags to be executed when that content is loaded into the editor. The attack requires user interaction (loading the malicious content into the editor) and network-level access, but no authentication or special privileges. An attacker can exploit this to execute arbitrary JavaScript in the context of the affected web application, potentially leading to session hijacking, credential theft, or data exfiltration. The vulnerability has been patched in TinyMCE 5.11.0 LTS, 6.8.4, and 7.2.0.

Affected products

  • Tiny TinyMCE before 5.11.0, 6.0.0 before 6.8.4, 7.0.0 before 7.2.0

Identifiers

  • CVE-2024-38357
  • GHSA-w9jx-4g6g-rp7x
  • PYSEC-2026-1302

Timeline

  • 2024-06-19: disclosed: Vulnerability published as GHSA-w9jx-4g6g-rp7x
  • 2024-06-19: patched: Patches released: TinyMCE 5.11.0 LTS, 6.8.4, and 7.2.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.