Safety vulnerability ID: 78730
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Affected versions of the django-tinymce package are vulnerable to Cross-site Scripting (XSS) due to improper validation in the noneditable_regexp option. The content extraction code using the noneditable_regexp option fails to verify that HTML attribute contents fully conform to the configured regular expression before inclusion, allowing execution of embedded malicious scripts. An attacker can exploit this by including specially crafted HTML attributes that bypass the noneditable_regexp filter, causing django-tinymce to execute unintended script when content is extracted, compromising user confidentiality and integrity.
Latest version: 4.1.0
A Django application that contains a widget to render a
This vulnerability has no description
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application