VulnerableCode Package Details - pkg:composer/tinymce/tinymce@6.8.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-19e1-nmzz-6ugf Aliases: CVE-2024-29203 GHSA-438c-3975-5x3f	TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `iframe` elements containing malicious code to execute when inserted into the editor. These `iframe` elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets. This vulnerability is fixed in 6.8.1.	6.8.1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-8qew-evef-fqfr Aliases: CVE-2026-47760 GHSA-mh5m-5hw4-5c69	TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.	7.1.0 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-h158-313q-vfhp Aliases: CVE-2024-38356 GHSA-9hcv-j9pv-qmph	TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the `noneditable_regexp` option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the `noneditable_regexp` option, any content within an attribute is properly verified to match the configured regular expression before being added. Users are advised to upgrade. There are no known workarounds for this vulnerability.	6.8.4 Affected by 0 other vulnerabilities. 7.2.0 Affected by 0 other vulnerabilities.
VCID-kuks-gdgb-pqda Aliases: CVE-2024-38357 GHSA-w9jx-4g6g-rp7x	TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.	6.8.4 Affected by 0 other vulnerabilities. 7.2.0 Affected by 0 other vulnerabilities.
VCID-pzzt-thru-r3h2 Aliases: CVE-2024-29881 GHSA-5359-pvf2-pw78	TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an `object` or `embed` element and that image could potentially contain a XSS payload. This vulnerability is fixed in 6.8.1 and 7.0.0.	7.0.0 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-19e1-nmzz-6ugf
Aliases:
CVE-2024-29203
GHSA-438c-3975-5x3f

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `iframe` elements containing malicious code to execute when inserted into the editor. These `iframe` elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets. This vulnerability is fixed in 6.8.1.

6.8.1
Affected by 3 other vulnerabilities.

VCID-8qew-evef-fqfr
Aliases:
CVE-2026-47760
GHSA-mh5m-5hw4-5c69

TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.

7.1.0
Affected by 2 other vulnerabilities.

VCID-h158-313q-vfhp
Aliases:
CVE-2024-38356
GHSA-9hcv-j9pv-qmph

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the `noneditable_regexp` option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the `noneditable_regexp` option, any content within an attribute is properly verified to match the configured regular expression before being added. Users are advised to upgrade. There are no known workarounds for this vulnerability.

6.8.4
Affected by 0 other vulnerabilities.

7.2.0
Affected by 0 other vulnerabilities.

VCID-kuks-gdgb-pqda
Aliases:
CVE-2024-38357
GHSA-w9jx-4g6g-rp7x

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.

6.8.4
Affected by 0 other vulnerabilities.

7.2.0
Affected by 0 other vulnerabilities.

VCID-pzzt-thru-r3h2
Aliases:
CVE-2024-29881
GHSA-5359-pvf2-pw78

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an `object` or `embed` element and that image could potentially contain a XSS payload. This vulnerability is fixed in 6.8.1 and 7.0.0.

7.0.0
Affected by 2 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-12T19:33:33.430022+00:00	GitLab Importer	Affected by	VCID-kuks-gdgb-pqda	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/tinymce/tinymce/CVE-2024-38357.yml	38.6.0
2026-06-12T19:33:30.988410+00:00	GitLab Importer	Affected by	VCID-h158-313q-vfhp	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/tinymce/tinymce/CVE-2024-38356.yml	38.6.0
2026-06-12T19:24:11.945831+00:00	GitLab Importer	Affected by	VCID-pzzt-thru-r3h2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/tinymce/tinymce/CVE-2024-29881.yml	38.6.0
2026-06-12T19:24:10.977461+00:00	GitLab Importer	Affected by	VCID-19e1-nmzz-6ugf	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/tinymce/tinymce/CVE-2024-29203.yml	38.6.0
2026-06-11T20:38:59.887783+00:00	GHSA Importer	Affected by	VCID-8qew-evef-fqfr	https://github.com/advisories/GHSA-mh5m-5hw4-5c69	38.6.0