CVE-2024-29504: Summernote

High severity, CVSS 7.6. EPSS: 0.7% chance of exploitation in the next 30 days.

Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payload to the codeview parameter.

Affected products

• Summernote Summernote: up to and including 0.8.18

Published 2024-04-10. Last modified 2026-06-17.