Search for packages
| purl | pkg:npm/tinymce@6.8.3 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-4v71-gmu2-akgq
Aliases: CVE-2024-38356 GHSA-9hcv-j9pv-qmph |
Duplicate This advisory duplicates another. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-nqmt-kv4x-juhy
Aliases: CVE-2024-38357 GHSA-w9jx-4g6g-rp7x |
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements A [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-nztv-wcuq-jubt
Aliases: CVE-2024-29881 GHSA-5359-pvf2-pw78 |
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements A [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an `object` or `embed` element and that image could potentially contain a XSS payload. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-06T05:08:52.302905+00:00 | GitLab Importer | Affected by | VCID-nqmt-kv4x-juhy | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/tinymce/CVE-2024-38357.yml | 38.6.0 |
| 2026-06-06T05:08:51.018387+00:00 | GitLab Importer | Affected by | VCID-4v71-gmu2-akgq | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/tinymce/CVE-2024-38356.yml | 38.6.0 |
| 2026-06-06T04:47:21.513078+00:00 | GitLab Importer | Affected by | VCID-nztv-wcuq-jubt | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/tinymce/CVE-2024-29881.yml | 38.6.0 |