PYSEC-2026-1302 TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

Impact A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. Patches This vulnerability has been patched in TinyMCE 7.2.0,...

bpp-iplweb (>=202304.1100.0, <=202504.1174.0), django-user-notification (>=0.8.0, <=0.10.2) +2 more potentially affected by CVE-2024-38357 via django-tinymce (3.7.1)

django-tinymce PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - bpp-iplweb =202304.1100.0, =0.8.0, =4.3.0, =0.64.0, =0.93.1 Source cves: CVE-2024-38357 Source advisory: OSV:PYSEC-2026-1302...

TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

ImpactA cross-site scripting XSS vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. PatchesThis vulnerability has been patched in TinyMCE 7.2.0,...

geonode (>=4.1.0, <=4.2.5), grooveshop-django-api (>=0.6.0, <=0.63.0) +1 more potentially affected by CVE-2024-38357 via django-tinymce (3.6.1)

django-tinymce PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - geonode =4.1.0, =0.6.0, =0.63.0 - repomaker 1.0.0b1 Source cves: CVE-2024-38357 Source advisory: OSV:PYSEC-2026-1302...

django-saas-email (>=0.1.21, <=0.1.29) potentially affected by CVE-2024-38357 via django-tinymce (2.7.0)

django-tinymce PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - django-saas-email =0.1.21, =0.1.29 Source cves: CVE-2024-38357 Source advisory: OSV:PYSEC-2026-1302...

repomaker (1.0.0b3) potentially affected by CVE-2024-38357 via django-tinymce (2.9.0)

django-tinymce PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - repomaker 1.0.0b3 Source cves: CVE-2024-38357 Source advisory: OSV:PYSEC-2026-1302...

grooveshop-django-api (>=0.94.0, <=0.127.0) potentially affected by CVE-2024-38357 via django-tinymce (4.0.0)

django-tinymce PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - grooveshop-django-api =0.94.0, =0.127.0 Source cves: CVE-2024-38357 Source advisory: OSV:PYSEC-2026-1302...

hazard-feed (>=0.2.0, <=0.2.5) potentially affected by CVE-2024-38357 via django-tinymce (3.2.0)

django-tinymce PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - hazard-feed =0.2.0, =0.2.5 Source cves: CVE-2024-38357 Source advisory: OSV:PYSEC-2026-1302...

zinnia-wysiwyg-tinymce (1.4.0) potentially affected by CVE-2024-38357 via django-tinymce (2.2.0)

django-tinymce PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - zinnia-wysiwyg-tinymce 1.4.0 Source cves: CVE-2024-38357 Source advisory: OSV:PYSEC-2026-1302...

hazard-feed (>=0.1.3.2, <=0.1.6.1) potentially affected by CVE-2024-38356 via django-tinymce (2.8.0)

django-tinymce PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - hazard-feed =0.1.3.2, =0.1.6.1 Source cves: CVE-2024-38356 Source advisory: OSV:PYSEC-2026-1301...

PYSEC-2026-1301 TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

Impact A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditableregexp option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. Patches This vulnerability...

grooveshop-django-api (>=0.94.0, <=0.127.0) potentially affected by CVE-2024-38356 via django-tinymce (4.0.0)

django-tinymce PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - grooveshop-django-api =0.94.0, =0.127.0 Source cves: CVE-2024-38356 Source advisory: OSV:PYSEC-2026-1301...

hazard-feed (>=0.2.0, <=0.2.5) potentially affected by CVE-2024-38356 via django-tinymce (3.2.0)

django-tinymce PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - hazard-feed =0.2.0, =0.2.5 Source cves: CVE-2024-38356 Source advisory: OSV:PYSEC-2026-1301...

TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

ImpactA cross-site scripting XSS vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditableregexp option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. PatchesThis vulnerability h...

django-saas-email (>=0.1.21, <=0.1.29) potentially affected by CVE-2024-38356 via django-tinymce (2.7.0)

django-tinymce PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - django-saas-email =0.1.21, =0.1.29 Source cves: CVE-2024-38356 Source advisory: OSV:PYSEC-2026-1301...

zinnia-wysiwyg-tinymce (1.4.0) potentially affected by CVE-2024-21910 via django-tinymce (2.2.0)

django-tinymce PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - zinnia-wysiwyg-tinymce 1.4.0 Source cves: CVE-2024-21910 Source advisory: OSV:PYSEC-2026-632...

PYSEC-2026-632 Cross-site scripting vulnerability in TinyMCE plugins

Impact A cross-site scripting XSS vulnerability was discovered in the URL processing logic of the image and link plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the...

tinyblog (>=0.4.0, <=0.5.2) potentially affected by CVE-2024-21910 via django-tinymce (1.5.3)

django-tinymce PYPI version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - tinyblog =0.4.0, =0.5.2 Source cves: CVE-2024-21910 Source advisory: OSV:PYSEC-2026-632...

geonode (3.3.3), hazard-feed (>=0.2.0, <=0.2.5) potentially affected by CVE-2024-21910 via django-tinymce (>=3.2.0, <=3.3.0)

django-tinymce PYPI version =3.2.0, =0.2.0, =0.2.5 Source cves: CVE-2024-21910 Source advisory: OSV:PYSEC-2026-632...

hazard-feed (>=0.1.3.2, <=0.1.6.1) potentially affected by CVE-2024-21910 via django-tinymce (2.8.0)

django-tinymce PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - hazard-feed =0.1.3.2, =0.1.6.1 Source cves: CVE-2024-21910 Source advisory: OSV:PYSEC-2026-632...