Medium severity4.3NVD Advisory· Published Mar 26, 2024· Updated Jun 17, 2026
CVE-2024-29881
CVE-2024-29881
Description
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or embed element and that image could potentially contain a XSS payload. This vulnerability is fixed in 6.8.1 and 7.0.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tinymce/tinymcePackagist | < 7.0.0 | 7.0.0 |
tinymcenpm | < 7.0.0 | 7.0.0 |
TinyMCENuGet | < 7.0.0 | 7.0.0 |
Affected products
5- ghsa-coords3 versions
< 7.0.0+ 2 more
- (no CPE)range: < 7.0.0
- (no CPE)range: < 7.0.0
- (no CPE)range: < 7.0.0
Patches
Vulnerability mechanics
References
6- github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1nvdPatchWEB
- github.com/advisories/GHSA-5359-pvf2-pw78ghsaADVISORY
- github.com/tinymce/tinymce/security/advisories/GHSA-5359-pvf2-pw78nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-29881ghsaADVISORY
- www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes/nvdRelease NotesWEB
- www.tiny.cloud/docs/tinymce/7/7.0-release-notes/nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.