TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
Impact
A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed iframe elements containing malicious code to execute when inserted into the editor. These iframe elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets.
Fix
TinyMCE 6.8.1 introduced a new sandbox_iframes boolean option which adds the sandbox="" attribute to every iframe element by default when enabled. This will prevent cross-origin, and in special cases same-origin, XSS by embedded resources in iframe elements. From TinyMCE 7.0.0 onwards the default value of this option is true.
In TinyMCE 7.0.0 a new sandbox_iframes_exclusions option was also added, allowing a list of domains to be specified that should be excluded from having the sandbox="" attribute applied when the sandbox_iframes option is enabled. By default, this option is set to an array of domains that are provided in embed code by popular websites. To sandbox iframe elements from every domain, set this option to [].
Workarounds
The HTTP Content-Security-Policy (CSP) frame-src or object-src can be configured to restrict or block the loading of unauthorized URLS. Refer to the TinyMCE Content Security Policy Guide.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | tinymce/tinymce | < 6.8.1 | 6.8.1 |
| npm package | tinymce | < 6.8.1 | 6.8.1 |
| .NET (NuGet) | TinyMCE | < 6.8.1 | 6.8.1 |
References
- https://github.com/tinymce/tinymce/security/advisories/GHSA-438c-3975-5x3f
- https://nvd.nist.gov/vuln/detail/CVE-2024-29203
- https://github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1
- https://github.com/tinymce/tinymce
- https://www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes/#new-convert_unsafe_embeds-option-that-controls-whether-object-and-embed-elements-will-be-converted-to-more-restrictive-alternatives-namely-img-for-image-mime-types-video-for-video-mime-types-audio-audio-mime-types-or-iframe-for-other-or-unspecified-mime-types
- https://www.tiny.cloud/docs/tinymce/7/7.0-release-notes/#sandbox_iframes-editor-option-is-now-defaulted-to-true
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-79- Platform
- Composer, npm, .NET (NuGet)
- Package
tinymce/tinymce, tinymce, TinyMCE- Disclosed
- 26.03.2024
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-438c-3975-5x3f - CC BY 4.0
Vulnerability history: tinymce/tinymce
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 15
- First → latest
- 01.2021 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 4
- Medium 11
Disclosures per year
- 2021: 3
- 2022: 1
- 2023: 3
- 2024: 4
- 2025: 0
- 2026: 4
-
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.