-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from inadequate regex validation when restoring non-editable content from 'data-mce-content' attributes. The pre-patch code in NonEditableFilter.ts's setup function directly converted nodes to text content without verifying if the content matched the configured regular expressions. The commit added an 'isValidContent' check that ensures full regex match before processing, and removes nodes that don't comply. This directly addresses the XSS vector described in CVE-2024-38356.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tinymce | npm | < 5.11.0 | 5.11.0 |
| TinyMCE | nuget | < 5.11.0 | 5.11.0 |
| tinymce/tinymce | composer | < 5.11.0 | 5.11.0 |
| tinymce | npm | >= 6.0.0, < 6.8.4 | 6.8.4 |
| tinymce | npm | >= 7.0.0, < 7.2.0 | 7.2.0 |
| TinyMCE | nuget | >= 6.0.0, < 6.8.4 | 6.8.4 |
| TinyMCE | nuget | >= 7.0.0, < 7.2.0 | 7.2.0 |
| tinymce/tinymce | composer | >= 6.0.0, < 6.8.4 | 6.8.4 |
| tinymce/tinymce | composer | >= 7.0.0, < 7.2.0 | 7.2.0 |
| django-tinymce | pip | <= 4.0.0 | 4.1.0 |