{"action":"Upgrade tinymce to 6.8.1 or later.","affected":[{"fixed":"6.8.1","introduced":"0"}],"component":"tinymce","cve_ids":["CVE-2024-29203"],"ecosystem":"npm","epss":0.00713,"exploited":false,"fixed_versions":["6.8.1"],"ghsa_id":"GHSA-438c-3975-5x3f","id":"tcs_01M5KETFV19AF44M82ZBHFK48N","modified_at":"2026-09-10T03:50:10.591117659Z","published_at":"2024-03-26T21:23:47Z","references":["https://osv.dev/vulnerability/GHSA-438c-3975-5x3f","https://github.com/tinymce/tinymce/security/advisories/GHSA-438c-3975-5x3f","https://nvd.nist.gov/vuln/detail/CVE-2024-29203","https://github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1","https://github.com/tinymce/tinymce","https://www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes/#new-convert_unsafe_embeds-option-that-controls-whether-object-and-embed-elements-will-be-converted-to-more-restrictive-alternatives-namely-img-for-image-mime-types-video-for-video-mime-types-audio-audio-mime-types-or-iframe-for-other-or-unspecified-mime-types","https://www.tiny.cloud/docs/tinymce/7/7.0-release-notes/#sandbox_iframes-editor-option-is-now-defaulted-to-true"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-438c-3975-5x3f","url":"https://osv.dev/vulnerability/GHSA-438c-3975-5x3f"}],"summary":"TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes"}