CVE-2024-37629: Summernote v0.9.1 XSS Vulnerability

CVE-2024-37629 Overview

CVE-2024-37629 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Summernote v0.9.1, a widely deployed open-source WYSIWYG editor for Bootstrap. The flaw resides in the editor's Code View function, which allows users to switch between rich text and raw HTML editing. When an attacker submits crafted HTML or JavaScript through Code View, the payload executes in the browser context of any user who renders the stored content. The vulnerability requires user interaction and can be triggered across security scopes, enabling session theft, defacement, and phishing against applications embedding Summernote.

Critical Impact
Attackers can inject arbitrary JavaScript through the Code View editor, executing scripts in the context of victim browsers and compromising confidentiality and integrity of user sessions.

Affected Products

Summernote WYSIWYG editor version 0.8.18
Summernote v0.9.1 (as reported in the original advisory)
Web applications embedding vulnerable Summernote builds

Discovery Timeline

2024-06-12 - CVE-2024-37629 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37629

Vulnerability Analysis

Summernote provides a Code View toggle that exposes the raw HTML of the editor content to end users. The Code View function fails to sanitize HTML and JavaScript before re-rendering the content back into the editor's contenteditable region. An attacker who can submit editor content, either directly or through a shared document workflow, can inject <script>, <img onerror>, <svg onload>, and similar payloads. When the content is rendered by another user, the injected script executes in that user's browser session.

The issue is classified as reflected and stored XSS depending on how the host application persists editor content. Because the scope changes from the vulnerable component to the parent web application, attackers can access cookies, tokens, and DOM state belonging to the embedding site.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79] within Summernote's Code View handler. The editor treats Code View content as trusted markup and reinserts it into the DOM without HTML entity encoding or attribute sanitization. No allowlist of tags or attributes is enforced before re-render.

Attack Vector

Exploitation requires an attacker to submit crafted HTML through the Code View feature and a victim to view the rendered content. The attack is network-reachable and requires user interaction. Public write-ups, including the Grumpz CVE-2024-37629 analysis, describe simple payloads such as event-handler-based script execution injected via the Code View pane. See the upstream GitHub Issue #4642 for maintainer discussion.

Detection Methods for CVE-2024-37629

Indicators of Compromise

HTTP POST bodies containing <script>, onerror=, onload=, or javascript: sequences submitted to endpoints that persist Summernote content
Stored database records for editor fields containing unescaped <script> or event-handler attributes
Browser console errors or Content Security Policy (CSP) violations originating from user-generated content pages
Outbound requests from user browsers to attacker-controlled domains after loading pages rendered by Summernote

Detection Strategies

Deploy a web application firewall (WAF) rule matching XSS patterns in requests targeting Summernote save endpoints
Scan stored editor content in the database for HTML tags and event handlers outside a defined allowlist
Enable CSP report-only mode to surface inline script execution on pages that render Summernote output
Correlate anomalous outbound DNS queries from client browsers with pageviews of user-generated content

Monitoring Recommendations

Log all requests to editor save and preview endpoints with full request bodies for retrospective analysis
Alert on repeated submissions containing script sentinels from a single source IP or authenticated account
Monitor for privileged account sessions being accessed from new geolocations shortly after viewing user-generated content

How to Mitigate CVE-2024-37629

Immediate Actions Required

Inventory all web applications and CMS plugins bundling Summernote and identify versions in use
Disable the Code View button in Summernote configuration for untrusted user roles until a sanitizer is in place
Apply server-side HTML sanitization such as DOMPurify or OWASP Java HTML Sanitizer on all editor content before storage and rendering
Deploy a strict Content Security Policy that blocks inline scripts and untrusted external script sources

Patch Information

No vendor-issued patch is referenced in the NVD entry for CVE-2024-37629 at the time of publication. Consult the Summernote GitHub repository for upstream status and the v0.9.1 release notes for version details. Until an upstream fix is released, treat all Summernote content as untrusted and sanitize it server-side.

Workarounds

Remove codeview from the Summernote toolbar configuration to prevent users from toggling raw HTML input
Pass all saved editor output through a server-side HTML sanitizer that enforces a tag and attribute allowlist
Set the HttpOnly and Secure flags on session cookies to reduce impact of successful script execution
Apply a Content Security Policy header with script-src 'self' and no unsafe-inline directive on pages that render editor content

bash

# Configuration example: disable Code View in Summernote toolbar
$('#editor').summernote({
  toolbar: [
    ['style', ['bold', 'italic', 'underline']],
    ['para', ['ul', 'ol', 'paragraph']],
    ['insert', ['link']]
    // 'codeview' intentionally omitted to mitigate CVE-2024-37629
  ]
});