Cross-site scripting vulnerability in TinyMCE
Summary
CVE-2024-21911: Cross-site scripting vulnerability in TinyMCE. Affects tinymce versions < 5.6.0. Fixed in 5.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinyMCE is a popular open-source WYSIWYG editor that allows users to easily create and edit rich text content. It is widely used in various web applications and content management systems. However, versions 5.5.1 and lower of TinyMCE are vulnerable to a cross-site scripting (XSS) attack. This vulnerability allows an attacker to execute arbitrary JavaScript code when a specially crafted piece of content is inserted into the editor using the clipboard or APIs.
Vulnerability Detail
The XSS vulnerability in TinyMCE is due to a flaw in the URL sanitization logic of the core parser. This flaw allows an attacker to inject malicious JavaScript code into the editor, which can then be executed in the context of the user's browser. The impact of this vulnerability is significant as it can lead to various attacks, including session hijacking, defacement of websites, and theft of sensitive information. The vulnerability has been assigned a moderate severity level (CWE-79) and has been acknowledged by Tiny Technologies.
How To Fix
Latest published version: 8.10.0 as of 23 Oct 2026
npm install tinymce@8.10.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.6.0
This is the first release that contains the fix.
npm install tinymce@5.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, there are two workarounds available. The first workaround is to manually sanitize the iframe, object, and embed URL attributes using a TinyMCE node filter. This involves iterating through the nodes and attributes, sanitizing the attribute values, and updating the nodes accordingly. The second workaround is to disable the iframe, object, and embed elements in the content by configuring the invalid_elements setting. This prevents the insertion of these elements and reduces the risk of XSS attacks.
Conclusion
The XSS vulnerability in TinyMCE can have serious consequences for web applications and content management systems. It is crucial to promptly address this vulnerability by upgrading to the patched version or implementing the recommended workarounds. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tinymce →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of the user's browser. This can lead to various attacks, including session hijacking, defacement of websites, and theft of sensitive information.
Versions 5.5.1 and lower of TinyMCE are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to TinyMCE version 5.6.0 or higher.
Yes, if upgrading is not immediately feasible, you can manually sanitize the iframe, object, and embed URL attributes using a TinyMCE node filter or disable these elements in the content using the invalid_elements setting.
This vulnerability was discovered by Aaron Bishop at SecurityMetrics and reported to Tiny Technologies.
References
Related vulnerabilities
Recent vulnerabilities recorded for tinymce.
