{"action":"Upgrade tinymce to 7.0.0 or later.","affected":[{"fixed":"7.0.0","introduced":"0"}],"component":"tinymce","cve_ids":["CVE-2024-29881"],"ecosystem":"npm","epss":0.00713,"exploited":false,"fixed_versions":["7.0.0"],"ghsa_id":"GHSA-5359-pvf2-pw78","id":"tcs_01M5KEVHGKF8RX1722H65Q11G1","modified_at":"2026-09-10T03:50:10.436142638Z","published_at":"2024-03-26T21:23:45Z","references":["https://osv.dev/vulnerability/GHSA-5359-pvf2-pw78","https://github.com/tinymce/tinymce/security/advisories/GHSA-5359-pvf2-pw78","https://nvd.nist.gov/vuln/detail/CVE-2024-29881","https://github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1","https://github.com/tinymce/tinymce","https://www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes/#new-convert_unsafe_embeds-option-that-controls-whether-object-and-embed-elements-will-be-converted-to-more-restrictive-alternatives-namely-img-for-image-mime-types-video-for-video-mime-types-audio-audio-mime-types-or-iframe-for-other-or-unspecified-mime-types","https://www.tiny.cloud/docs/tinymce/7/7.0-release-notes/#convert_unsafe_embeds-editor-option-is-now-defaulted-to-true"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-5359-pvf2-pw78#npm/tinymce","url":"https://osv.dev/vulnerability/GHSA-5359-pvf2-pw78"}],"summary":"TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements"}