Search for packages
| purl | pkg:npm/tinymce@6.8.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-49u4-f94p-rbfy
Aliases: CVE-2024-29203 GHSA-438c-3975-5x3f |
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes A [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `iframe` elements containing malicious code to execute when inserted into the editor. These `iframe` elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets. |
Affected by 3 other vulnerabilities. |
|
VCID-4v71-gmu2-akgq
Aliases: CVE-2024-38356 GHSA-9hcv-j9pv-qmph |
Duplicate This advisory duplicates another. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-aqcy-kxr3-mkgm
Aliases: CVE-2026-47760 GHSA-mh5m-5hw4-5c69 |
TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0. |
Affected by 2 other vulnerabilities. |
|
VCID-nqmt-kv4x-juhy
Aliases: CVE-2024-38357 GHSA-w9jx-4g6g-rp7x |
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements A [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-nztv-wcuq-jubt
Aliases: CVE-2024-29881 GHSA-5359-pvf2-pw78 |
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements A [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an `object` or `embed` element and that image could potentially contain a XSS payload. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-06T05:08:52.295167+00:00 | GitLab Importer | Affected by | VCID-nqmt-kv4x-juhy | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/tinymce/CVE-2024-38357.yml | 38.6.0 |
| 2026-06-06T05:08:51.009121+00:00 | GitLab Importer | Affected by | VCID-4v71-gmu2-akgq | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/tinymce/CVE-2024-38356.yml | 38.6.0 |
| 2026-06-06T04:47:21.505114+00:00 | GitLab Importer | Affected by | VCID-nztv-wcuq-jubt | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/tinymce/CVE-2024-29881.yml | 38.6.0 |
| 2026-06-06T04:47:19.475314+00:00 | GitLab Importer | Affected by | VCID-49u4-f94p-rbfy | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/tinymce/CVE-2024-29203.yml | 38.6.0 |
| 2026-06-05T22:08:28.842134+00:00 | GHSA Importer | Affected by | VCID-aqcy-kxr3-mkgm | https://github.com/advisories/GHSA-mh5m-5hw4-5c69 | 38.6.0 |