TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `iframe` elements containing malicious code to execute when inserted into the editor. These `iframe` elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets. This vulnerability is fixed in 6.8.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tinymce | tinymce | before 6.8.1 | 6.8.1 | Patch available | CNA |
| — | tinymce (npm) | before 6.8.1 | 6.8.1 | Patch available | GHSA-438c-3975-5x3f |
| — | TinyMCE (NuGet) | before 6.8.1 | 6.8.1 | Patch available | GHSA-438c-3975-5x3f |
| — | tinymce/tinymce (Packagist) | before 6.8.1 | 6.8.1 | Patch available | GHSA-438c-3975-5x3f |
- tinymce Vendortinymce Affected before 6.8.1 Fixed in 6.8.1 Patch available CNA
- tinymce (npm) Vendor— Affected before 6.8.1 Fixed in 6.8.1 Patch available GHSA-438c-3975-5x3f
- TinyMCE (NuGet) Vendor— Affected before 6.8.1 Fixed in 6.8.1 Patch available GHSA-438c-3975-5x3f
- tinymce/tinymce (Packagist) Vendor— Affected before 6.8.1 Fixed in 6.8.1 Patch available GHSA-438c-3975-5x3f
Remediation
- Fix · CNA tinymce (tinymce) Fixed in 6.8.1
- Fix · GHSA-438c-3975-5x3f tinymce (npm) Fixed in 6.8.1 Advisory →
- Fix · GHSA-438c-3975-5x3f TinyMCE (NuGet) Fixed in 6.8.1 Advisory →
- Fix · GHSA-438c-3975-5x3f tinymce/tinymce (Packagist) Fixed in 6.8.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-29203
- 2026-10-03 Alias added: GHSA-438c-3975-5x3f
References
Advisory 2
Other 3
- https://www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes/#new-convert_unsafe_embeds-option-that-controls-whether-object-and-embed-elements-will-be-converted-to-more-restrictive-alternatives-namely-img-for-image-mime-types-video-for-video-mime-types-audio-audio-mime-types-or-iframe-for-other-or-unspecified-mime-types
- https://www.tiny.cloud/docs/tinymce/7/7.0-release-notes/#sandbox_iframes-editor-option-is-now-defaulted-to-true
- https://github.com/tinymce/tinymce
More tinymce vulnerabilities
- TI-2011-04153 Static code injection vulnerability in inc/function.base.php in Ajax File and Image… CVSS 2.0HIGH 7.5
- TI-2026-81439 Cross-site scripting in TinyMCE media plugin via data-mce-object CVSS 4.0HIGH 8.5
- TI-2026-35259 TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments CVSS 3.1HIGH 8.7
- TI-2026-35258 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection CVSS 3.1HIGH 8.7
- TI-2026-35256 TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes CVSS 3.1HIGH 8.7
- TI-2026-35257 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs CVSS 3.1HIGH 8.7
Sources
- CVE-2024-29203 · CVE Program
- CVE-2024-29203 · NVD
- FIRST EPSS
- GHSA-438c-3975-5x3f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences