CVE-2024-29203: Tiny TinyMCE XSS Vulnerability

CVE-2024-29203 Overview

CVE-2024-29203 is a cross-site scripting (XSS) vulnerability in TinyMCE, an open source rich text editor. The flaw resides in the editor's content insertion code, where iframe elements containing malicious code execute when inserted into the editor. Same-origin browser protections restrict the permissions of these iframe elements, but attackers can still trigger operations such as downloading malicious assets. The issue is fixed in TinyMCE 6.8.1. This vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can inject iframe elements into TinyMCE content to execute script in the editor context, enabling asset download abuse and client-side attacks against users who interact with untrusted content.

Affected Products

Tiny TinyMCE versions prior to 6.8.1
Applications embedding vulnerable TinyMCE builds for user-generated content
Web platforms exposing the editor to untrusted input

Discovery Timeline

2024-03-26 - CVE-2024-29203 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29203

Vulnerability Analysis

TinyMCE processes rich content pasted or inserted through its editor APIs. Before version 6.8.1, the content insertion code accepted iframe elements without applying restrictive sandboxing or conversion. An attacker crafting malicious markup could embed an iframe referencing attacker-controlled resources. When the editor rendered the content, the browser evaluated the frame according to standard origin rules.

Browser same-origin protections limit direct access to the parent document. However, the frame still issues network requests, downloads assets, and executes script in its own context. This provides a workable XSS surface for phishing overlays, drive-by downloads, and tracking payloads served through the host application.

Root Cause

The root cause is missing neutralization of embedded frame elements during content insertion. TinyMCE did not offer a default option to convert or sandbox iframe, object, and embed tags. Any application accepting third-party HTML through the editor inherited this behavior, exposing readers of that content to script execution.

Attack Vector

Exploitation requires user interaction: a victim must load or view content that contains the malicious iframe. A network-based attacker submits crafted HTML through any interface that feeds TinyMCE (comments, articles, form fields). Rendering the stored content triggers the frame and its payload.

typescript

// Security patch: modules/tinymce/src/core/main/ts/api/Options.ts
// Adds sandbox_iframes and convert_unsafe_embeds options
    default: 'off',
  });

+  registerOption('sandbox_iframes', {
+    processor: 'boolean',
+    default: false
+  });
+
+  registerOption('convert_unsafe_embeds', {
+    processor: 'boolean',
+    default: false
+  });
+
  // These options must be registered later in the init sequence due to their default values
  editor.on('ScriptsLoaded', () => {
    registerOption('directionality', {

Source: TinyMCE commit bcdea2a

Detection Methods for CVE-2024-29203

Indicators of Compromise

Stored content in application databases containing <iframe>, <object>, or <embed> tags with external src attributes not originating from a trusted allowlist.
Outbound requests from user browsers to unexpected third-party domains immediately after loading editor-rendered pages.
TinyMCE bundles reporting a version earlier than 6.8.1 in JavaScript asset paths or manifests.

Detection Strategies

Inventory web applications using TinyMCE and identify deployed versions using dependency scanners and software composition analysis.
Inspect stored user-generated content for frame-based tags and unusual attribute values (srcdoc, data: URIs, javascript: handlers).
Add web application firewall rules that flag POST bodies containing iframe or embed markup where such tags are not expected.

Monitoring Recommendations

Log and review Content Security Policy (CSP) violation reports for frame-src, child-src, and object-src directives.
Monitor egress traffic from browsers rendering CMS or comment pages for connections to low-reputation domains.
Alert on new TinyMCE builds served from CDNs to detect unauthorized version rollbacks.

How to Mitigate CVE-2024-29203

Immediate Actions Required

Upgrade TinyMCE to version 6.8.1 or later, or to TinyMCE 7.0 where sandbox_iframes defaults to true.
Enable the new sandbox_iframes and convert_unsafe_embeds editor options across all TinyMCE integrations.
Audit stored content produced by vulnerable versions and sanitize any residual iframe, object, or embed tags.

Patch Information

The fix is delivered in TinyMCE 6.8.1 via commit bcdea2a. Full remediation details are documented in the GitHub Security Advisory GHSA-438c-3975-5x3f, the TinyMCE 6.8.1 Release Notes, and the TinyMCE 7.0 Release Notes.

Workarounds

Apply a strict Content Security Policy that restricts frame-src, child-src, and object-src to trusted origins only.
Sanitize HTML server-side using an allowlist parser before passing content to the editor or displaying stored records.
Restrict editor usage to authenticated, trusted users until the upgrade is deployed across the environment.

bash

# Configuration example: enable sandboxing in TinyMCE 6.8.1+
tinymce.init({
  selector: 'textarea',
  sandbox_iframes: true,
  convert_unsafe_embeds: true
});