MediumFix available
roundcube — security advisory
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Products
- roundcube
- Affected versions
- 1.4.11+dfsg.1-4, 1.5.0+dfsg.1-2, 1.5.0+dfsg.1-2ubuntu0.1~esm1, 1.5.0+dfsg.1-2ubuntu0.1~esm2, 1.5.0+dfsg.1-2ubuntu0.1~esm3, 1.5.0+dfsg.1-2ubuntu0.1~esm4, 1.5.0+dfsg.1-2ubuntu0.1~esm5, 1.6.10+dfsg-1, 1.6.10+dfsg-2, 1.6.11+dfsg-1, 1.6.11+dfsg-1ubuntu0.26.04.1~esm1, 1.6.2+dfsg-1, 1.6.4+dfsg-1, 1.6.5+dfsg-1, 1.6.6+dfsg-1, 1.6.6+dfsg-2, 1.6.6+dfsg-2ubuntu0.1, 1.6.6+dfsg-2ubuntu0.1+esm1, 1.6.6+dfsg-2ubuntu0.1+esm2
- Fixed versions
- 1.5.0+dfsg.1-2ubuntu0.1~esm6, 1.6.6+dfsg-2ubuntu0.1+esm3
- CVEs
- CVE-2024-38357
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:08 UTC · Revision 1
Source evidence
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.
osv:UBUNTU-CVE-2024-38357
roundcube
Fixed versions: 1.5.0+dfsg.1-2ubuntu0.1~esm6
roundcube
Fixed versions: 1.6.6+dfsg-2ubuntu0.1+esm3
roundcube
Fixed versions: Not specified
roundcube
Fixed versions: Not specified
roundcube
Fixed versions: Not specified
Complete source record
{
"id": "f553ed1fb3ec66d9652c1a63ae94d6dc0ead6294701d10c3fae4bc5f654f1a32",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-38357",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2024-38357",
"summary": "TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
"evidence": "osv:UBUNTU-CVE-2024-38357",
"products": [
{
"name": {
"value": "roundcube",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.0+dfsg.1-2ubuntu0.1~esm6",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "1.4.11+dfsg.1-4",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.0+dfsg.1-2",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.0+dfsg.1-2ubuntu0.1~esm1",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.0+dfsg.1-2ubuntu0.1~esm2",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.0+dfsg.1-2ubuntu0.1~esm3",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.0+dfsg.1-2ubuntu0.1~esm4",
"evidence": "/affected/0/versions"
},
{
"value": "1.5.0+dfsg.1-2ubuntu0.1~esm5",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "roundcube",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.6.6+dfsg-2ubuntu0.1+esm3",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "1.6.2+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.4+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.5+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.6+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.6+dfsg-2",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.6+dfsg-2ubuntu0.1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.6+dfsg-2ubuntu0.1+esm1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.6+dfsg-2ubuntu0.1+esm2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "roundcube",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6.10+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.10+dfsg-2",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.11+dfsg-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "roundcube",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6.11+dfsg-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "roundcube",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6.11+dfsg-1",
"evidence": "/affected/4/versions"
},
{
"value": "1.6.11+dfsg-1ubuntu0.26.04.1~esm1",
"evidence": "/affected/4/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2024-38357",
"aliases": [
"UBUNTU-CVE-2024-38357"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0+dfsg.1-2ubuntu0.1~esm6"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/ubuntu/roundcube?arch=source&distro=esm-apps%2Fjammy",
"ecosystem": "Ubuntu:Pro:22.04:LTS"
},
"versions": [
"1.4.11+dfsg.1-4",
"1.5.0+dfsg.1-2",
"1.5.0+dfsg.1-2ubuntu0.1~esm1",
"1.5.0+dfsg.1-2ubuntu0.1~esm2",
"1.5.0+dfsg.1-2ubuntu0.1~esm3",
"1.5.0+dfsg.1-2ubuntu0.1~esm4",
"1.5.0+dfsg.1-2ubuntu0.1~esm5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38357.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "roundcube",
"binary_version": "1.5.0+dfsg.1-2ubuntu0.1~esm6"
},
{
"binary_name": "roundcube-core",
"binary_version": "1.5.0+dfsg.1-2ubuntu0.1~esm6"
},
{
"binary_name": "roundcube-mysql",
"binary_version": "1.5.0+dfsg.1-2ubuntu0.1~esm6"
},
{
"binary_name": "roundcube-pgsql",
"binary_version": "1.5.0+dfsg.1-2ubuntu0.1~esm6"
},
{
"binary_name": "roundcube-plugins",
"binary_version": "1.5.0+dfsg.1-2ubuntu0.1~esm6"
},
{
"binary_name": "roundcube-sqlite3",
"binary_version": "1.5.0+dfsg.1-2ubuntu0.1~esm6"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.6+dfsg-2ubuntu0.1+esm3"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/ubuntu/roundcube?arch=source&distro=esm-apps%2Fnoble",
"ecosystem": "Ubuntu:Pro:24.04:LTS"
},
"versions": [
"1.6.2+dfsg-1",
"1.6.4+dfsg-1",
"1.6.5+dfsg-1",
"1.6.6+dfsg-1",
"1.6.6+dfsg-2",
"1.6.6+dfsg-2ubuntu0.1",
"1.6.6+dfsg-2ubuntu0.1+esm1",
"1.6.6+dfsg-2ubuntu0.1+esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38357.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "roundcube",
"binary_version": "1.6.6+dfsg-2ubuntu0.1+esm3"
},
{
"binary_name": "roundcube-core",
"binary_version": "1.6.6+dfsg-2ubuntu0.1+esm3"
},
{
"binary_name": "roundcube-mysql",
"binary_version": "1.6.6+dfsg-2ubuntu0.1+esm3"
},
{
"binary_name": "roundcube-pgsql",
"binary_version": "1.6.6+dfsg-2ubuntu0.1+esm3"
},
{
"binary_name": "roundcube-plugins",
"binary_version": "1.6.6+dfsg-2ubuntu0.1+esm3"
},
{
"binary_name": "roundcube-sqlite3",
"binary_version": "1.6.6+dfsg-2ubuntu0.1+esm3"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/ubuntu/roundcube?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.6.10+dfsg-1",
"1.6.10+dfsg-2",
"1.6.11+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38357.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "roundcube",
"binary_version": "1.6.11+dfsg-1"
},
{
"binary_name": "roundcube-core",
"binary_version": "1.6.11+dfsg-1"
},
{
"binary_name": "roundcube-mysql",
"binary_version": "1.6.11+dfsg-1"
},
{
"binary_name": "roundcube-pgsql",
"binary_version": "1.6.11+dfsg-1"
},
{
"binary_name": "roundcube-plugins",
"binary_version": "1.6.11+dfsg-1"
},
{
"binary_name": "roundcube-sqlite3",
"binary_version": "1.6.11+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/ubuntu/roundcube?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.6.11+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38357.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "roundcube",
"binary_version": "1.6.11+dfsg-1"
},
{
"binary_name": "roundcube-core",
"binary_version": "1.6.11+dfsg-1"
},
{
"binary_name": "roundcube-mysql",
"binary_version": "1.6.11+dfsg-1"
},
{
"binary_name": "roundcube-pgsql",
"binary_version": "1.6.11+dfsg-1"
},
{
"binary_name": "roundcube-plugins",
"binary_version": "1.6.11+dfsg-1"
},
{
"binary_name": "roundcube-sqlite3",
"binary_version": "1.6.11+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/ubuntu/roundcube?arch=source&distro=esm-apps%2Fresolute",
"ecosystem": "Ubuntu:Pro:26.04:LTS"
},
"versions": [
"1.6.11+dfsg-1",
"1.6.11+dfsg-1ubuntu0.26.04.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38357.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "roundcube",
"binary_version": "1.6.11+dfsg-1ubuntu0.26.04.1~esm1"
},
{
"binary_name": "roundcube-core",
"binary_version": "1.6.11+dfsg-1ubuntu0.26.04.1~esm1"
},
{
"binary_name": "roundcube-mysql",
"binary_version": "1.6.11+dfsg-1ubuntu0.26.04.1~esm1"
},
{
"binary_name": "roundcube-pgsql",
"binary_version": "1.6.11+dfsg-1ubuntu0.26.04.1~esm1"
},
{
"binary_name": "roundcube-plugins",
"binary_version": "1.6.11+dfsg-1ubuntu0.26.04.1~esm1"
},
{
"binary_name": "roundcube-sqlite3",
"binary_version": "1.6.11+dfsg-1ubuntu0.26.04.1~esm1"
}
]
}
}
],
"modified": "2026-10-17T12:56:36.990559914Z",
"provider": "osv",
"upstream": [
"CVE-2024-38357"
],
"references": [
"https://ubuntu.com/security/CVE-2024-38357",
"https://www.cve.org/CVERecord?id=CVE-2024-38357",
"https://github.com/tinymce/tinymce/security/advisories/GHSA-w9jx-4g6g-rp7x",
"https://github.com/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d",
"https://owasp.org/www-community/attacks/xss",
"https://www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/#overview",
"https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview",
"https://ubuntu.com/security/notices/USN-8223-1"
]
},
"related_cves": [
{
"value": "CVE-2024-38357",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 355855,
"published_at": "2024-06-19T20:15:00+00:00"
}