TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser.
References
| Link | Resource |
|---|---|
| https://github.com/advisories/GHSA-r8hm-w5f7-wj39 | Exploit Third Party Advisory |
| https://github.com/jazzband/django-tinymce/issues/366 | Issue Tracking Third Party Advisory |
| https://github.com/jazzband/django-tinymce/releases/tag/3.4.0 | Release Notes |
| https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39 | Third Party Advisory |
| https://pypi.org/project/django-tinymce/3.4.0/ | Release Notes |
| https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39 | Third Party Advisory |
| https://github.com/advisories/GHSA-r8hm-w5f7-wj39 | Exploit Third Party Advisory |
| https://github.com/jazzband/django-tinymce/issues/366 | Issue Tracking Third Party Advisory |
| https://github.com/jazzband/django-tinymce/releases/tag/3.4.0 | Release Notes |
| https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39 | Third Party Advisory |
| https://pypi.org/project/django-tinymce/3.4.0/ | Release Notes |
| https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39 | Third Party Advisory |
Configurations
History
28 Nov 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser. |
Information
Published : 2024-01-03 16:15
Updated : 2025-11-28 16:15
NVD link : CVE-2024-21910
Mitre link : CVE-2024-21910
CVE.ORG link : CVE-2024-21910
JSON object : View
Products Affected
tiny
- tinymce
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')