{
  "cveId": "CVE-2024-38356",
  "url": "https://patchblox.com/security/cve/CVE-2024-38356",
  "summary": "CVE-2024-38356 is fixed in 6 products on 1 platform, first by roundcube 1.5.0\u002Bdfsg.1-2ubuntu0.1~esm6, released February 10, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "roundcube: TinyMCE is an open source rich text editor",
  "description": "TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE\u2019s content extraction code. When using the \u0060noneditable_regexp\u0060 option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the \u0060noneditable_regexp\u0060 option, any content within an attribute is properly verified to match the configured regular expression before being added. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
  "published": "2024-06-19T13:15:00Z",
  "severity": "Medium",
  "epss": 0.00529,
  "epssPercentile": 0.45002,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "roundcube",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.5.0\u002Bdfsg.1-2ubuntu0.1~esm6",
      "fix": "roundcube 1.5.0\u002Bdfsg.1-2ubuntu0.1~esm6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-roundcube-1.5.0-dfsg.1-2ubuntu0.1-esm6",
      "released": "2026-02-10T21:16:00Z"
    },
    {
      "platform": "linux",
      "product": "roundcube",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.6.6\u002Bdfsg-2ubuntu0.1\u002Besm3",
      "fix": "roundcube 1.6.6\u002Bdfsg-2ubuntu0.1\u002Besm3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-roundcube-1.6.6-dfsg-2ubuntu0.1-esm3",
      "released": "2026-02-10T21:16:00Z"
    },
    {
      "platform": "linux",
      "product": "roundcube-core",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.5.0\u002Bdfsg.1-2ubuntu0.1~esm6",
      "fix": "roundcube-core 1.5.0\u002Bdfsg.1-2ubuntu0.1~esm6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-roundcube-core-1.5.0-dfsg.1-2ubuntu0.1-esm6",
      "released": "2026-02-10T21:16:00Z"
    },
    {
      "platform": "linux",
      "product": "roundcube-core",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.6.6\u002Bdfsg-2ubuntu0.1\u002Besm3",
      "fix": "roundcube-core 1.6.6\u002Bdfsg-2ubuntu0.1\u002Besm3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-roundcube-core-1.6.6-dfsg-2ubuntu0.1-esm3",
      "released": "2026-02-10T21:16:00Z"
    },
    {
      "platform": "linux",
      "product": "roundcube-mysql",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.5.0\u002Bdfsg.1-2ubuntu0.1~esm6",
      "fix": "roundcube-mysql 1.5.0\u002Bdfsg.1-2ubuntu0.1~esm6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-roundcube-mysql-1.5.0-dfsg.1-2ubuntu0.1-esm6",
      "released": "2026-02-10T21:16:00Z"
    },
    {
      "platform": "linux",
      "product": "roundcube-mysql",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.6.6\u002Bdfsg-2ubuntu0.1\u002Besm3",
      "fix": "roundcube-mysql 1.6.6\u002Bdfsg-2ubuntu0.1\u002Besm3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-roundcube-mysql-1.6.6-dfsg-2ubuntu0.1-esm3",
      "released": "2026-02-10T21:16:00Z"
    },
    {
      "platform": "linux",
      "product": "roundcube-pgsql",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.5.0\u002Bdfsg.1-2ubuntu0.1~esm6",
      "fix": "roundcube-pgsql 1.5.0\u002Bdfsg.1-2ubuntu0.1~esm6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-roundcube-pgsql-1.5.0-dfsg.1-2ubuntu0.1-esm6",
      "released": "2026-02-10T21:16:00Z"
    },
    {
      "platform": "linux",
      "product": "roundcube-pgsql",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.6.6\u002Bdfsg-2ubuntu0.1\u002Besm3",
      "fix": "roundcube-pgsql 1.6.6\u002Bdfsg-2ubuntu0.1\u002Besm3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-roundcube-pgsql-1.6.6-dfsg-2ubuntu0.1-esm3",
      "released": "2026-02-10T21:16:00Z"
    },
    {
      "platform": "linux",
      "product": "roundcube-plugins",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.5.0\u002Bdfsg.1-2ubuntu0.1~esm6",
      "fix": "roundcube-plugins 1.5.0\u002Bdfsg.1-2ubuntu0.1~esm6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-roundcube-plugins-1.5.0-dfsg.1-2ubuntu0.1-esm6",
      "released": "2026-02-10T21:16:00Z"
    },
    {
      "platform": "linux",
      "product": "roundcube-plugins",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.6.6\u002Bdfsg-2ubuntu0.1\u002Besm3",
      "fix": "roundcube-plugins 1.6.6\u002Bdfsg-2ubuntu0.1\u002Besm3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-roundcube-plugins-1.6.6-dfsg-2ubuntu0.1-esm3",
      "released": "2026-02-10T21:16:00Z"
    },
    {
      "platform": "linux",
      "product": "roundcube-sqlite3",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.5.0\u002Bdfsg.1-2ubuntu0.1~esm6",
      "fix": "roundcube-sqlite3 1.5.0\u002Bdfsg.1-2ubuntu0.1~esm6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-roundcube-sqlite3-1.5.0-dfsg.1-2ubuntu0.1-esm6",
      "released": "2026-02-10T21:16:00Z"
    },
    {
      "platform": "linux",
      "product": "roundcube-sqlite3",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.6.6\u002Bdfsg-2ubuntu0.1\u002Besm3",
      "fix": "roundcube-sqlite3 1.6.6\u002Bdfsg-2ubuntu0.1\u002Besm3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-roundcube-sqlite3-1.6.6-dfsg-2ubuntu0.1-esm3",
      "released": "2026-02-10T21:16:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}