Vulnerability-Lookup

CVE-2024-21910 (GCVE-0-2024-21910)

Vulnerability from cvelistv5 – Published: 2024-01-03 15:55 – Updated: 2026-07-14 22:54

Title

Cross-site scripting vulnerability in TinyMCE plugins

Summary

TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-01-09 20:43 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck mitre root

References

6 references

URL	Tags
https://github.com/tinymce/tinymce/security/advis…	vendor-advisory
https://github.com/jazzband/django-tinymce/issues/366	issue-tracking
https://github.com/jazzband/django-tinymce/releas…	related
https://pypi.org/project/django-tinymce/3.4.0/	related
https://github.com/advisories/GHSA-r8hm-w5f7-wj39	vendor-advisory
https://vulncheck.com/advisories/vc-advisory-GHSA…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
		Affected: 0 , < 5.10.0 (semver 2.0.0) cpe:2.3:a:tiny:tinymce::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:35:34.686Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
          },
          {
            "tags": [
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://github.com/jazzband/django-tinymce/issues/366"
          },
          {
            "tags": [
              "related",
              "x_transferred"
            ],
            "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
          },
          {
            "tags": [
              "related",
              "x_transferred"
            ],
            "url": "https://pypi.org/project/django-tinymce/3.4.0/"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-21910",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-09T20:43:59.537981Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-18T15:38:04.887Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://nuget.org/packages",
          "defaultStatus": "unaffected",
          "packageName": "TinyMCE",
          "packageURL": "pkg:nuget/TinyMCE",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver 2.0.0"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.0",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eTinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user\u0027s browser.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user\u0027s browser."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T22:54:36.517Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/jazzband/django-tinymce/issues/366"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://pypi.org/project/django-tinymce/3.4.0/"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Cross-site scripting vulnerability in TinyMCE plugins",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-21910",
    "datePublished": "2024-01-03T15:55:27.061Z",
    "dateReserved": "2024-01-03T14:21:17.583Z",
    "dateUpdated": "2026-07-14T22:54:36.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-21910",
      "date": "2026-09-20",
      "epss": "0.00956",
      "percentile": "0.59878"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "1CDEC000-8A31-496B-9137-F71208146F9D",
                  "versionEndExcluding": "5.10.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user\u0027s browser.\n"
        },
        {
          "lang": "es",
          "value": "Las versiones de TinyMCE anteriores a la 5.10.0 se ven afectadas por una vulnerabilidad de cross site scripting. Un atacante remoto y no autenticado podr\u00eda introducir im\u00e1genes manipuladas o URL de enlaces que dar\u00edan como resultado la ejecuci\u00f3n de JavaScript arbitrario en el navegador de un usuario que est\u00e9 editando."
        }
      ],
      "id": "CVE-2024-21910",
      "lastModified": "2024-11-21T08:55:15.320",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 2.7,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-01-03T16:15:09.090",
      "references": [
        {
          "source": "disclosure@vulncheck.com",
          "tags": [
            "Exploit",
            "Third Party Advisory"
          ],
          "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
        },
        {
          "source": "disclosure@vulncheck.com",
          "tags": [
            "Issue Tracking",
            "Third Party Advisory"
          ],
          "url": "https://github.com/jazzband/django-tinymce/issues/366"
        },
        {
          "source": "disclosure@vulncheck.com",
          "tags": [
            "Release Notes"
          ],
          "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
        },
        {
          "source": "disclosure@vulncheck.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
        },
        {
          "source": "disclosure@vulncheck.com",
          "tags": [
            "Release Notes"
          ],
          "url": "https://pypi.org/project/django-tinymce/3.4.0/"
        },
        {
          "source": "disclosure@vulncheck.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Exploit",
            "Third Party Advisory"
          ],
          "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Issue Tracking",
            "Third Party Advisory"
          ],
          "url": "https://github.com/jazzband/django-tinymce/issues/366"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Release Notes"
          ],
          "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Release Notes"
          ],
          "url": "https://pypi.org/project/django-tinymce/3.4.0/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39"
        }
      ],
      "sourceIdentifier": "disclosure@vulncheck.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-79"
            }
          ],
          "source": "disclosure@vulncheck.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-79"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://nuget.org/packages",
                "defaultStatus": "unaffected",
                "packageName": "TinyMCE",
                "packageURL": "pkg:nuget/TinyMCE",
                "versions": [
                  {
                    "lessThan": "5.10.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver 2.0.0"
                  }
                ]
              }
            ],
            "source": "disclosure@vulncheck.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1CDEC000-8A31-496B-9137-F71208146F9D",
                    "versionEndExcluding": "5.10.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user\u0027s browser."
          },
          {
            "lang": "es",
            "value": "Las versiones de TinyMCE anteriores a la 5.10.0 se ven afectadas por una vulnerabilidad de cross site scripting. Un atacante remoto y no autenticado podr\u00eda introducir im\u00e1genes manipuladas o URL de enlaces que dar\u00edan como resultado la ejecuci\u00f3n de JavaScript arbitrario en el navegador de un usuario que est\u00e9 editando."
          }
        ],
        "id": "CVE-2024-21910",
        "lastModified": "2026-07-14T23:17:14.457",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-21910",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-09T20:43:59.537981Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-01-03T16:15:09.090",
        "references": [
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://github.com/jazzband/django-tinymce/issues/366"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://pypi.org/project/django-tinymce/3.4.0/"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://github.com/jazzband/django-tinymce/issues/366"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes"
            ],
            "url": "https://pypi.org/project/django-tinymce/3.4.0/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39"
          }
        ],
        "sourceIdentifier": "disclosure@vulncheck.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "disclosure@vulncheck.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-11-28T17:11:36+00:00",
      "cve": "CVE-2024-21910",
      "id": "CVE-2024-21910",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Cross-site scripting vulnerability in TinyMCE plugins",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-21910.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-01T22:35:34.686Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "vendor-advisory",
                  "x_transferred"
                ],
                "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
              },
              {
                "tags": [
                  "issue-tracking",
                  "x_transferred"
                ],
                "url": "https://github.com/jazzband/django-tinymce/issues/366"
              },
              {
                "tags": [
                  "related",
                  "x_transferred"
                ],
                "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
              },
              {
                "tags": [
                  "related",
                  "x_transferred"
                ],
                "url": "https://pypi.org/project/django-tinymce/3.4.0/"
              },
              {
                "tags": [
                  "third-party-advisory",
                  "x_transferred"
                ],
                "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
              },
              {
                "tags": [
                  "third-party-advisory",
                  "x_transferred"
                ],
                "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 6.1,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "LOW",
                  "integrityImpact": "LOW",
                  "privilegesRequired": "NONE",
                  "scope": "CHANGED",
                  "userInteraction": "REQUIRED",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-21910",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-01-09T20:43:59.537981Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-06-18T15:37:59.990Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://nuget.org/packages",
              "defaultStatus": "unaffected",
              "packageName": "TinyMCE",
              "packageURL": "pkg:nuget/TinyMCE",
              "versions": [
                {
                  "lessThan": "5.10.0",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver 2.0.0"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.0",
                      "versionStartIncluding": "0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "OR"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cspan style=\"background-color: transparent;\"\u003eTinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user\u0027s browser.\u003c/span\u003e\u003cbr\u003e"
                }
              ],
              "value": "TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user\u0027s browser."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-14T22:54:36.517Z",
            "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
            "shortName": "VulnCheck"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
            },
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://github.com/jazzband/django-tinymce/issues/366"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://pypi.org/project/django-tinymce/3.4.0/"
            },
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
            },
            {
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39"
            }
          ],
          "source": {
            "discovery": "INTERNAL"
          },
          "title": "Cross-site scripting vulnerability in TinyMCE plugins",
          "x_generator": {
            "engine": "vulncheck"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "assignerShortName": "VulnCheck",
        "cveId": "CVE-2024-21910",
        "datePublished": "2024-01-03T15:55:27.061Z",
        "dateReserved": "2024-01-03T14:21:17.583Z",
        "dateUpdated": "2026-07-14T22:54:36.517Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2024-21910

Vulnerability from fkie_nvd - Published: 2024-01-03 16:15 - Updated: 2026-07-14 23:17

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
disclosure@vulncheck.com	https://github.com/advisories/GHSA-r8hm-w5f7-wj39	Exploit, Third Party Advisory
disclosure@vulncheck.com	https://github.com/jazzband/django-tinymce/issues/366	Issue Tracking, Third Party Advisory
disclosure@vulncheck.com	https://github.com/jazzband/django-tinymce/releases/tag/3.4.0	Release Notes
disclosure@vulncheck.com	https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39	Third Party Advisory
disclosure@vulncheck.com	https://pypi.org/project/django-tinymce/3.4.0/	Release Notes
disclosure@vulncheck.com	https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/advisories/GHSA-r8hm-w5f7-wj39	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/jazzband/django-tinymce/issues/366	Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/jazzband/django-tinymce/releases/tag/3.4.0	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://pypi.org/project/django-tinymce/3.4.0/	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39	Third Party Advisory

Impacted products

	Vendor	Product	Version
	tiny	tinymce	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://nuget.org/packages",
          "defaultStatus": "unaffected",
          "packageName": "TinyMCE",
          "packageURL": "pkg:nuget/TinyMCE",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver 2.0.0"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1CDEC000-8A31-496B-9137-F71208146F9D",
              "versionEndExcluding": "5.10.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user\u0027s browser."
    },
    {
      "lang": "es",
      "value": "Las versiones de TinyMCE anteriores a la 5.10.0 se ven afectadas por una vulnerabilidad de cross site scripting. Un atacante remoto y no autenticado podr\u00eda introducir im\u00e1genes manipuladas o URL de enlaces que dar\u00edan como resultado la ejecuci\u00f3n de JavaScript arbitrario en el navegador de un usuario que est\u00e9 editando."
    }
  ],
  "id": "CVE-2024-21910",
  "lastModified": "2026-07-14T23:17:14.457",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-21910",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-01-09T20:43:59.537981Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-01-03T16:15:09.090",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://github.com/jazzband/django-tinymce/issues/366"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://pypi.org/project/django-tinymce/3.4.0/"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://github.com/jazzband/django-tinymce/issues/366"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://pypi.org/project/django-tinymce/3.4.0/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-R8HM-W5F7-WJ39

Vulnerability from github – Published: 2021-11-02 15:42 – Updated: 2024-01-03 22:33

Summary

Cross-site scripting vulnerability in TinyMCE plugins

Details

Impact

A cross-site scripting (XSS) vulnerability was discovered in the URL processing logic of the image and link plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the dangerous URLs were stripped in any content extracted from the editor. This impacts all users who are using TinyMCE 5.9.2 or lower.

Patches

This vulnerability has been patched in TinyMCE 5.10.0 by improved sanitization logic when updating URLs in the relevant plugins.

Workarounds

To work around this vulnerability, either: - Upgrade to TinyMCE 5.10.0 or higher - Disable the image and link plugins

Acknowledgements

Tiny Technologies would like to thank Yakir6 for discovering this vulnerability.

References

https://www.tiny.cloud/docs/release-notes/release-notes510/#securityfixes

For more information

If you have any questions or comments about this advisory: * Email us at infosec@tiny.cloud * Open an issue in the TinyMCE repo

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "tinymce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "tinymce/tinymce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "TinyMCE"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "django-tinymce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-21910"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-64",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-01T20:02:43Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nA cross-site scripting (XSS) vulnerability was discovered in the URL processing logic of the `image` and `link` plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the dangerous URLs were stripped in any content extracted from the editor. This impacts all users who are using TinyMCE 5.9.2 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 5.10.0 by improved sanitization logic when updating URLs in the relevant plugins.\n\n### Workarounds\nTo work around this vulnerability, either:\n- Upgrade to TinyMCE 5.10.0 or higher\n- Disable the `image` and `link` plugins\n\n### Acknowledgements\nTiny Technologies would like to thank Yakir6 for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes510/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)\n* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)",
  "id": "GHSA-r8hm-w5f7-wj39",
  "modified": "2024-01-03T22:33:13Z",
  "published": "2021-11-02T15:42:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jazzband/django-tinymce/issues/366"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tinymce/tinymce"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/django-tinymce/3.4.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-site scripting vulnerability in TinyMCE plugins"
}

GSD-2024-21910

Vulnerability from gsd - Updated: 2024-01-04 06:02

Details

Aliases

CVE-2024-21910

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-21910"
      ],
      "details": "TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user\u0027s browser.\n",
      "id": "GSD-2024-21910",
      "modified": "2024-01-04T06:02:16.267525Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "disclosure@vulncheck.com",
        "ID": "CVE-2024-21910",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user\u0027s browser.\n"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-79",
                "lang": "eng",
                "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39",
            "refsource": "MISC",
            "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
          },
          {
            "name": "https://github.com/jazzband/django-tinymce/issues/366",
            "refsource": "MISC",
            "url": "https://github.com/jazzband/django-tinymce/issues/366"
          },
          {
            "name": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0",
            "refsource": "MISC",
            "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
          },
          {
            "name": "https://pypi.org/project/django-tinymce/3.4.0/",
            "refsource": "MISC",
            "url": "https://pypi.org/project/django-tinymce/3.4.0/"
          },
          {
            "name": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39",
            "refsource": "MISC",
            "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
          },
          {
            "name": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39",
            "refsource": "MISC",
            "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39"
          }
        ]
      },
      "source": {
        "discovery": "INTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1CDEC000-8A31-496B-9137-F71208146F9D",
                    "versionEndExcluding": "5.10.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user\u0027s browser.\n"
          },
          {
            "lang": "es",
            "value": "Las versiones de TinyMCE anteriores a la 5.10.0 se ven afectadas por una vulnerabilidad de cross site scripting. Un atacante remoto y no autenticado podr\u00eda introducir im\u00e1genes manipuladas o URL de enlaces que dar\u00edan como resultado la ejecuci\u00f3n de JavaScript arbitrario en el navegador de un usuario que est\u00e9 editando."
          }
        ],
        "id": "CVE-2024-21910",
        "lastModified": "2024-01-08T19:46:25.757",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2024-01-03T16:15:09.090",
        "references": [
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://github.com/jazzband/django-tinymce/issues/366"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://pypi.org/project/django-tinymce/3.4.0/"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39"
          }
        ],
        "sourceIdentifier": "disclosure@vulncheck.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "disclosure@vulncheck.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

PYSEC-2026-632

Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:36

Details

Impact

Patches

This vulnerability has been patched in TinyMCE 5.10.0 by improved sanitization logic when updating URLs in the relevant plugins.

Workarounds

To work around this vulnerability, either: - Upgrade to TinyMCE 5.10.0 or higher - Disable the image and link plugins

Acknowledgements

Tiny Technologies would like to thank Yakir6 for discovering this vulnerability.

References

https://www.tiny.cloud/docs/release-notes/release-notes510/#securityfixes

For more information

If you have any questions or comments about this advisory: * Email us at infosec@tiny.cloud * Open an issue in the TinyMCE repo

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Impacted products

Name	purl
django-tinymce	pkg:pypi/django-tinymce

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "django-tinymce",
        "purl": "pkg:pypi/django-tinymce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0",
        "1.1",
        "1.2",
        "1.3",
        "1.4",
        "1.4.1",
        "1.5",
        "1.5.1",
        "1.5.1.dev100",
        "1.5.1.dev101",
        "1.5.1a1",
        "1.5.1a2",
        "1.5.1a3",
        "1.5.1b1",
        "1.5.1b2",
        "1.5.1b3",
        "1.5.1b4",
        "1.5.2",
        "1.5.3",
        "1.5.4",
        "2.0.0",
        "2.0.1",
        "2.0.2",
        "2.0.3",
        "2.0.4",
        "2.0.5",
        "2.0.6",
        "2.0.7",
        "2.1.0",
        "2.2.0",
        "2.3.0",
        "2.4.0",
        "2.5.0",
        "2.6.0",
        "2.6.1",
        "2.7.0",
        "2.7.1",
        "2.8.0",
        "2.9.0",
        "3.0.1",
        "3.0.2",
        "3.1.0",
        "3.2.0",
        "3.3.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-21910",
    "GHSA-r8hm-w5f7-wj39"
  ],
  "details": "### Impact\nA cross-site scripting (XSS) vulnerability was discovered in the URL processing logic of the `image` and `link` plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the dangerous URLs were stripped in any content extracted from the editor. This impacts all users who are using TinyMCE 5.9.2 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 5.10.0 by improved sanitization logic when updating URLs in the relevant plugins.\n\n### Workarounds\nTo work around this vulnerability, either:\n- Upgrade to TinyMCE 5.10.0 or higher\n- Disable the `image` and `link` plugins\n\n### Acknowledgements\nTiny Technologies would like to thank Yakir6 for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes510/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)\n* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)",
  "id": "PYSEC-2026-632",
  "modified": "2026-07-06T07:36:29.644577Z",
  "published": "2026-07-02T14:13:13.735617Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jazzband/django-tinymce/issues/366"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tinymce/tinymce"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/django-tinymce/3.4.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/django-tinymce"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21910"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-site scripting vulnerability in TinyMCE plugins"
}

UBUNTU-CVE-2024-21910 (CVE-2024-21910)

Vulnerability from osv_ubuntu – Published: 2024-01-03 16:15 – Updated: 2025-10-24 05:06 – Source website

Details

Severity

6.1 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-21910	REPORT
	https://github.com/tinymce/tinymce/security/advis…	REPORT
	https://github.com/jazzband/django-tinymce/issues/366	REPORT
	https://github.com/jazzband/django-tinymce/releas…	REPORT
	https://pypi.org/project/django-tinymce/3.4.0/	REPORT
	https://github.com/advisories/GHSA-r8hm-w5f7-wj39	REPORT
	https://vulncheck.com/advisories/vc-advisory-GHSA…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-21910	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "tinymce",
            "binary_version": "3.4.8+dfsg0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "tinymce",
        "purl": "pkg:deb/ubuntu/tinymce@3.4.8+dfsg0-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.4.8+dfsg0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "tinymce",
            "binary_version": "3.4.8+dfsg0-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "tinymce",
        "purl": "pkg:deb/ubuntu/tinymce@3.4.8+dfsg0-2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.4.8+dfsg0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "tinymce",
            "binary_version": "3.4.8+dfsg0-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "tinymce",
        "purl": "pkg:deb/ubuntu/tinymce@3.4.8+dfsg0-2?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.4.8+dfsg0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user\u0027s browser.",
  "id": "UBUNTU-CVE-2024-21910",
  "modified": "2025-10-24T05:06:51Z",
  "published": "2024-01-03T16:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-21910"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/jazzband/django-tinymce/issues/366"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/jazzband/django-tinymce/releases/tag/3.4.0"
    },
    {
      "type": "REPORT",
      "url": "https://pypi.org/project/django-tinymce/3.4.0/"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/advisories/GHSA-r8hm-w5f7-wj39"
    },
    {
      "type": "REPORT",
      "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21910"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-21910"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-21910 (GCVE-0-2024-21910)

FKIE_CVE-2024-21910

GHSA-R8HM-W5F7-WJ39

Impact

Patches

Workarounds

Acknowledgements

References

For more information

GSD-2024-21910

PYSEC-2026-632

Impact

Patches

Workarounds

Acknowledgements

References

For more information

UBUNTU-CVE-2024-21910 (CVE-2024-21910)

Tags

Sightings

Nomenclature

Related by attack behaviour