CVE-2024-38357: TinyMCE XSS Vulnerability

CVE-2024-38357 Overview

CVE-2024-38357 is a cross-site scripting (XSS) vulnerability in TinyMCE, an open source rich text editor widely embedded in content management systems and web applications. The flaw resides in TinyMCE's content parsing code, which failed to properly handle noscript elements. Specially crafted noscript elements containing malicious code could be executed when the content was loaded into the editor. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. The vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4, and TinyMCE 5.11.0 LTS.

Critical Impact
An attacker can inject script content inside a noscript element that executes in the victim's browser session when the payload is rendered by a vulnerable TinyMCE instance, enabling session theft, defacement, or client-side action hijacking.

Affected Products

TinyMCE versions prior to 5.11.0 LTS
TinyMCE versions prior to 6.8.4
TinyMCE versions prior to 7.2.0

Discovery Timeline

2024-06-19 - CVE-2024-38357 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38357

Vulnerability Analysis

TinyMCE's DomParser treated noscript as a special element whose contents were preserved as raw text. Because the parser did not descend into noscript children, script-like markup inside those elements was passed through the sanitization pipeline without normalization. When the editor later serialized or rendered that content in a context where scripting was enabled, the payload executed in the browser. Any application that loads untrusted HTML into TinyMCE, such as comment systems, ticketing platforms, or CMS previews, inherits this exposure. The bug affects the client-side editor surface and is triggered when a user opens or previews attacker-supplied content.

Root Cause

The parser's isSpecial check in DomParser.ts grouped noscript alongside other RCDATA-like elements whose contents are treated as opaque text. This prevented the recursive sanitization pass from inspecting nodes nested inside noscript, so filter rules that strip scripts, event handlers, and dangerous URIs never evaluated the payload.

Attack Vector

Exploitation requires user interaction: a victim must load attacker-controlled HTML into a vulnerable TinyMCE instance. A typical scenario is an application that stores user-submitted rich text and later re-renders it through the editor for review or editing. Because the CVSS scope is changed and the attack originates over the network, the payload can reach any user of the hosting application.

typescript

// Patch: modules/tinymce/src/core/main/ts/api/html/DomParser.ts
// TINY-11019 & TINY-11022 — exclude 'noscript' from RCDATA special-element handling
// so its children are parsed and sanitized rather than preserved verbatim.

  const parentName = parent.name;
  // Exclude the special elements where the content is RCDATA as their content needs to be parsed
  // See: https://html.spec.whatwg.org/multipage/parsing.html#parsing-html-fragments
- const isSpecial = parentName in specialElements && parentName !== 'title' && parentName !== 'textarea';
+ const isSpecial = parentName in specialElements && parentName !== 'title' && parentName !== 'textarea' && parentName !== 'noscript';

  const childNodes = nativeParent.childNodes;
  for (let ni = 0, nl = childNodes.length; ni < nl; ni++) {

Source: GitHub Commit 5acb741

Detection Methods for CVE-2024-38357

Indicators of Compromise

Stored rich-text content containing <noscript> tags wrapping <script>, <img onerror=...>, or javascript: URIs.
Browser console errors or Content Security Policy (CSP) violations originating from pages that render TinyMCE content.
Unexpected outbound requests from user browsers to attacker-controlled domains after loading editor previews.

Detection Strategies

Inventory web applications and identify the TinyMCE version served to clients; flag any deployment below 5.11.0, 6.8.4, or 7.2.0.
Scan stored HTML records in content databases for noscript elements containing executable markup or event handler attributes.
Deploy CSP with script-src restrictions and monitor report-uri or report-to endpoints for violations traceable to editor pages.

Monitoring Recommendations

Alert on web application firewall (WAF) events matching noscript payloads that contain <script>, on*=, or javascript: patterns.
Correlate authenticated session anomalies, such as new API tokens or profile changes, with recent editor page loads.
Track TinyMCE asset versions via periodic client-side telemetry or build pipeline SBOM checks.

How to Mitigate CVE-2024-38357

Immediate Actions Required

Upgrade all TinyMCE deployments to 7.2.0, 6.8.4, or 5.11.0 LTS depending on the supported branch in use.
Audit stored rich-text content for noscript-wrapped payloads and purge or re-sanitize suspect records before re-rendering.
Rotate session tokens and API keys for any user accounts that loaded suspect content into a vulnerable editor instance.

Patch Information

The fix is delivered in commit 5acb741 and released in TinyMCE 7.2.0, 6.8.4, and 5.11.0 LTS. See the TinyMCE 7.2 Release Notes, the TinyMCE 6.8.4 Release Notes, and GitHub Security Advisory GHSA-w9jx-4g6g-rp7x for full remediation details.

Workarounds

No official workarounds exist; the vendor advises upgrading to a patched release.
As a defense-in-depth measure, enforce a strict Content Security Policy that blocks inline scripts on pages hosting TinyMCE.
Server-side sanitize submitted HTML with a hardened library that strips noscript elements or their children before storage.

bash

# Verify the TinyMCE version bundled with your application
grep -R "tinymce" package.json package-lock.json yarn.lock 2>/dev/null | grep -Ei "tinymce\"?:\s*\"?\^?~?[0-9]"

# Upgrade via npm to a patched release on your supported branch
npm install tinymce@7.2.0    # current branch
npm install tinymce@6.8.4    # 6.x maintenance branch
npm install tinymce@5.11.0   # 5.x LTS branch