CVE-2024-21910: Cross-Site Scripting Vulnerability in django-tinymce
Summary
CVE-2024-21910: Cross-site scripting vulnerability in TinyMCE plugins. Affects django-tinymce versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Also tracked for
- tinymce · npm
The same CVE-2024-21910 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
django-tinymce is a Django application that integrates the TinyMCE rich text editor into Django projects. It allows developers to easily add a WYSIWYG editor to their web applications, enabling users to create and edit content with a user-friendly interface. The package is widely used for its simplicity and powerful features, but it has a vulnerability that can lead to security issues if not addressed.
Vulnerability Detail
A cross-site scripting (XSS) vulnerability was identified in the URL processing logic of the image and link plugins within django-tinymce. This flaw allows attackers to execute arbitrary JavaScript when users update an image or link with a specially crafted URL. The vulnerability primarily affects users during the editing process, as harmful URLs are stripped from any content extracted from the editor. This issue impacts all users utilizing django-tinymce versions 5.9.2 or lower.
How To Fix
Latest published version: 5.0.0 as of 22 Oct 2026
pip install --upgrade "django-tinymce==5.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
pip install --upgrade "django-tinymce==3.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, you can temporarily disable the image and link plugins to mitigate the risk. This can be done by modifying your TinyMCE configuration as follows:
TINYMCE_DEFAULT_CONFIG = {
'plugins': '...'
# Remove 'image' and 'link' from the plugins list
}
Conclusion
The CVE-2024-21910 vulnerability poses a significant risk to users of django-tinymce versions 5.9.2 and lower due to the potential for XSS attacks. It is crucial to upgrade to version 3.4.0 or higher to ensure the security of your application. Alternatively, disabling the affected plugins can serve as a temporary measure until an upgrade can be performed.
See every vulnerability recorded for django-tinymce →
FAQ
CVE-2024-21910 is a cross-site scripting vulnerability found in the django-tinymce package, affecting versions 5.9.2 and lower.
If your application uses django-tinymce versions 5.9.2 or lower, it may be vulnerable to XSS attacks, allowing attackers to execute malicious scripts in the context of the user.
You can disable the image and link plugins as a temporary workaround to mitigate the risk until you can upgrade.
Additional details can be found in the TinyMCE release notes and the advisory published by Tiny Technologies.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for django-tinymce.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
