关键漏洞信息 Security Fixes in TinyMCE 6.8.4 HTML Entities in noscript Elements Caused XSS Vulnerability - A cross-site scripting (XSS) vulnerability was discovered in TinyMCE's content parsing code. - Specially crafted elements containing malicious code could be executed when loaded into the editor. - Fixed by ensuring proper parsing of content within elements. - GHSA: GitHub Advisory - CVE: CVE-2024-38357 XSS Vulnerability via noneditable_regexp Option - A cross-site scripting (XSS) vulnerability was found in TinyMCE's content extraction code. - Specially crafted HTML attributes could execute malicious code when using the option. - Fixed by verifying content matches the configured regular expression before extraction. - GHSA: GitHub Advisory - CVE: CVE-2024-38356