A cross-site scripting (XSS) vulnerability exists in TCPDF versions before 6.7.4 due to improper handling of calls using HTML syntax. This flaw allows an attacker to execute malicious scripts in the context of the affected application. The vulnerability has been assigned CVE-2024-32489 and is rated medium severity with a CVSS score of 6.1. A fix is available in TCPDF version 6.7.4.