CVE-2024-21910: TinyMCE XSS Vulnerability in Rich Text Editor

CVE-2024-21910 Overview

CVE-2024-21910 is a cross-site scripting (XSS) vulnerability affecting TinyMCE versions prior to 5.10.0. The flaw allows a remote, unauthenticated attacker to craft malicious image or link URLs that execute arbitrary JavaScript in the browser of a user editing content in the affected rich-text editor. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Because TinyMCE is embedded across many content management systems and web applications, exploitation can affect a broad range of downstream products. See the TinyMCE Security Advisory for vendor details.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and unauthorized actions performed as the editing user.

Affected Products

TinyMCE versions before 5.10.0
django-tinymce versions before 3.4.0 (downstream integration)
Applications embedding vulnerable TinyMCE builds

Discovery Timeline

2024-01-03 - CVE-2024-21910 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2024-21910

Vulnerability Analysis

The vulnerability resides in how TinyMCE parses and renders URL attributes supplied for image and hyperlink elements. When a user inserts or edits an image or link, the editor accepts URL values without adequately neutralizing JavaScript-bearing schemes or scriptable payloads. Rendering the crafted attribute inside the editor causes the browser to execute the attacker-supplied JavaScript in the origin of the hosting application. This is a classic reflected or stored XSS scenario, depending on whether the crafted content is persisted server-side. Successful exploitation runs script under the privileges of the editing user, which frequently includes content authors or administrators. See the GitHub Security Advisory for additional context.

Root Cause

The root cause is insufficient input validation and output encoding of URL attributes for image (<img src>) and anchor (<a href>) elements. TinyMCE did not consistently reject or neutralize dangerous URI schemes such as javascript: or filter HTML injected through URL fields. The django-tinymce issue tracker documents how the flaw propagated into downstream integrations.

Attack Vector

Exploitation requires user interaction. An attacker supplies content containing a crafted image or link URL, either by submitting content that reaches an editor session or by luring an editing user to open a page that renders the payload inside TinyMCE. When the editor processes the URL, the injected JavaScript executes in the victim's browser under the origin of the vulnerable application. The attack traverses the network and does not require prior authentication of the attacker, though the victim must be an editing user with the vulnerable TinyMCE build loaded. Refer to the VulnCheck Advisory for exploitation notes.

No verified public proof-of-concept code is available for this issue. Consult the linked TinyMCE advisory for reproduction details.

Detection Methods for CVE-2024-21910

Indicators of Compromise

Content records containing javascript: URI schemes inside href or src attributes stored by the application.
HTTP request bodies to editor save endpoints containing HTML entities that decode to script-invoking URLs.
Unexpected outbound requests from editor sessions to attacker-controlled hosts shortly after content editing.

Detection Strategies

Inventory all applications and frameworks that bundle TinyMCE and identify versions older than 5.10.0.
Deploy Content Security Policy (CSP) reporting to surface script executions from inline handlers or non-approved sources.
Scan stored content in databases and object storage for URL attributes containing javascript:, data:text/html, or encoded variants.

Monitoring Recommendations

Log and alert on editor save operations that include suspicious URL schemes in image or link fields.
Monitor browser-side error and CSP violation reports for anomalies tied to content editing pages.
Correlate authenticated editor sessions with unusual API calls or privilege changes that may indicate session hijacking.

How to Mitigate CVE-2024-21910

Immediate Actions Required

Upgrade TinyMCE to version 5.10.0 or later across all applications and frameworks that embed the editor.
Update django-tinymce to version 3.4.0 or later where the packaged TinyMCE has been refreshed. See the django-tinymce 3.4.0 release and PyPI package information.
Audit stored content for previously injected payloads and remediate affected records.

Patch Information

TinyMCE addressed the vulnerability in version 5.10.0. The fix improves neutralization of URL attributes to prevent JavaScript execution through crafted image and link values. Downstream projects such as django-tinymce shipped the updated editor beginning with version 3.4.0. Full details are available in the TinyMCE Security Advisory.

Workarounds

Enforce a strict Content Security Policy that disallows inline script execution and restricts script sources.
Sanitize user-submitted HTML server-side with an allowlist that blocks javascript: and other script-executing URI schemes.
Restrict editor access to trusted users and require re-authentication for sensitive editing workflows until the patch is applied.

bash

# Configuration example: upgrade the vulnerable package
pip install --upgrade 'django-tinymce>=3.4.0'

# Verify installed TinyMCE version bundled with the application
grep -R "tinymce" ./static/ | grep -i version