CVE-2024-21908 Cross-site scripting vulnerability in TinyMCE

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser...

CVE-2024-21908

CVE-2024-21908 (TinyMCE) : Affected software versions are TinyMCE before 5.9.0. The issue is a stored cross-site scripting vulnerability where an unauthenticated, remote attacker can insert crafted HTML into the editor, leading to arbitrary JavaScript execution in another user’s browser. Root cau...

@agentlab/ldkg-ui-react (>=0.1.7, <=0.1.12), @belvoly-vue-aioa/tinymce (>=0.1.6, <=0.3.7) +109 more potentially affected by CVE-2024-21908 via tinymce (>=5.0.6, <=5.8.2)

tinymce NPM version =5.0.6, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =10.3.1-snapshot-1616513687673, =0.18.0, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.1, =0.0.1-alpha.1, =0.0.1-beta.1, =0.0.1-alpha.1, =0.0.17 and more Source cves: CVE-2024-21908 Source advisory: OSV:GHSA-5H9G-X5RV-25WG...