Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-124494 (GCVE-0-2026-124494)

Vulnerability from nvd – Published: 2026-11-08 13:16 – Updated: 2026-11-10 17:53

Title

SunEditor before 3.4.0 Stored XSS via &colon; Entity Sanitizer Bypass

Summary

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like &colon; to an empty string. Attackers can inject href values such as javascript&colon; that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 16:26 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	vendor-advisory
https://www.vulncheck.com/advisories/suneditor-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
JiHong88	suneditor	Affected: 0 , < 3.4.0 (semver) Unaffected: 3.4.0 (semver)

Date Public

2026-10-23 00:00

Credits

1diot9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124494",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T16:26:18.573220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T17:53:45.128Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/suneditor",
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "lessThan": "3.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "1diot9"
        }
      ],
      "datePublic": "2026-10-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer\u0027s _normalizeURL() function decodes named entities like \u0026colon; to an empty string. Attackers can inject href values such as javascript\u0026colon; that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T13:16:09.907Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-v4jx-8pj6-w4w8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-v4jx-8pj6-w4w8"
        },
        {
          "name": "VulnCheck Advisory: SunEditor before 3.4.0 Stored XSS via \u0026colon; Entity Sanitizer Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-colon-entity-sanitizer-bypass"
        }
      ],
      "title": "SunEditor before 3.4.0 Stored XSS via \u0026colon; Entity Sanitizer Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124494",
    "datePublished": "2026-11-08T13:16:09.907Z",
    "dateReserved": "2026-11-08T02:21:16.290Z",
    "dateUpdated": "2026-11-10T17:53:45.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124493 (GCVE-0-2026-124493)

Vulnerability from nvd – Published: 2026-11-08 13:16 – Updated: 2026-11-08 13:16

Title

SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent

Summary

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	vendor-advisory
https://www.vulncheck.com/advisories/suneditor-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
JiHong88	suneditor	Affected: 0 , < 3.4.0 (semver) Unaffected: 3.4.0 (semver)

Date Public

2026-10-23 00:00

Credits

iElloc

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "lessThan": "3.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "iElloc"
        }
      ],
      "datePublic": "2026-10-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T13:16:09.204Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-h9pq-57qf-vvfh)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-h9pq-57qf-vvfh"
        },
        {
          "name": "VulnCheck Advisory: SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-documenttype-header-textcontent"
        }
      ],
      "title": "SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124493",
    "datePublished": "2026-11-08T13:16:09.204Z",
    "dateReserved": "2026-11-08T02:21:16.290Z",
    "dateUpdated": "2026-11-08T13:16:09.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124492 (GCVE-0-2026-124492)

Vulnerability from nvd – Published: 2026-11-08 13:16 – Updated: 2026-11-08 13:16

Title

SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List

Summary

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	vendor-advisory
https://www.vulncheck.com/advisories/suneditor-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
JiHong88	suneditor	Affected: 0 , < 3.4.0 (semver) Unaffected: 3.4.0 (semver)

Date Public

2026-10-23 00:00

Credits

iElloc

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "lessThan": "3.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "iElloc"
        }
      ],
      "datePublic": "2026-10-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor\u0027s #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T13:16:08.514Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5pp5-5qrp-vq56)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-5pp5-5qrp-vq56"
        },
        {
          "name": "VulnCheck Advisory: SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-link-modal-bookmark-list"
        }
      ],
      "title": "SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124492",
    "datePublished": "2026-11-08T13:16:08.514Z",
    "dateReserved": "2026-11-08T02:21:16.290Z",
    "dateUpdated": "2026-11-08T13:16:08.514Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124491 (GCVE-0-2026-124491)

Vulnerability from nvd – Published: 2026-11-08 13:16 – Updated: 2026-11-09 14:18

Title

SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename

Summary

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 14:17 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	vendor-advisory
https://www.vulncheck.com/advisories/suneditor-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
JiHong88	suneditor	Affected: 0 , < 3.4.0 (semver) Unaffected: 3.4.0 (semver)

Date Public

2026-10-23 00:00

Credits

iElloc

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124491",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T14:17:52.580928Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T14:18:21.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-2w4v-r3v4-f5h4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "lessThan": "3.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "iElloc"
        }
      ],
      "datePublic": "2026-10-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims\u0027 browsers when content or gallery items load, enabling session theft."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T13:16:07.817Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2w4v-r3v4-f5h4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-2w4v-r3v4-f5h4"
        },
        {
          "name": "VulnCheck Advisory: SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-fileupload-plugin-filename"
        }
      ],
      "title": "SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124491",
    "datePublished": "2026-11-08T13:16:07.817Z",
    "dateReserved": "2026-11-08T02:21:16.290Z",
    "dateUpdated": "2026-11-09T14:18:21.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124422 (GCVE-0-2026-124422)

Vulnerability from nvd – Published: 2026-11-08 01:38 – Updated: 2026-11-10 17:56

Title

SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder

Summary

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 16:29 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	vendor-advisory
https://github.com/JiHong88/suneditor/commit/57db…	patch
https://github.com/JiHong88/suneditor/releases/ta…	release-notes
https://github.com/JiHong88/suneditor/blob/3.3.3/…	technical-description
https://www.vulncheck.com/advisories/suneditor-3.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
jihong88	suneditor	Affected: 3.0.0 , < 3.4.0 (semver)

Date Public

2026-10-23 18:49

Credits

kemrec manus-pi EclipsSec Zachariah Mithani (AploSec)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124422",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T16:29:37.766796Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T17:56:37.271Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/suneditor",
          "product": "suneditor",
          "repo": "https://github.com/JiHong88/suneditor",
          "vendor": "jihong88",
          "versions": [
            {
              "lessThan": "3.4.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "kemrec"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "manus-pi"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "EclipsSec"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Zachariah Mithani (AploSec)"
        }
      ],
      "datePublic": "2026-10-23T18:49:04.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:41.148Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-q867-q2hw-f8gp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-q867-q2hw-f8gp"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/JiHong88/suneditor/commit/57db24ac218cd10942fed0bb8288e9cb40b334bb"
        },
        {
          "name": "suneditor 3.4.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/JiHong88/suneditor/releases/tag/3.4.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/JiHong88/suneditor/blob/3.3.3/src/core/logic/dom/html.js#L336-L350"
        },
        {
          "name": "VulnCheck Advisory: SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/suneditor-3.0.0-before-3.4.0-stored-xss-via-html-clean-iframe-placeholder"
        }
      ],
      "title": "SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124422",
    "datePublished": "2026-11-08T01:38:41.148Z",
    "dateReserved": "2026-11-08T00:57:59.205Z",
    "dateUpdated": "2026-11-10T17:56:37.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59167 (GCVE-0-2026-59167)

Vulnerability from nvd – Published: 2026-09-23 13:52 – Updated: 2026-09-24 14:52

Title

SunEditor: Critical XSS vulnerability - sanitizer bypass

Summary

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 14:24 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	x_refsource_CONFIRM
https://github.com/JiHong88/suneditor/issues/1646	x_refsource_MISC
https://github.com/JiHong88/suneditor/commit/a94a…	x_refsource_MISC
https://github.com/JiHong88/suneditor/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
JiHong88	suneditor	Affected: < 2.47.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59167",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T14:24:21.114425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T14:52:33.658Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.47.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application\u0027s browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T13:52:56.747Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/issues/1646",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/issues/1646"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/commit/a94ace269c7102bfb6de58a27a6547bc4eb09045",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/commit/a94ace269c7102bfb6de58a27a6547bc4eb09045"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/releases/tag/2.47.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/releases/tag/2.47.11"
        }
      ],
      "source": {
        "advisory": "GHSA-6rf4-v2fh-m6p4",
        "discovery": "UNKNOWN"
      },
      "title": "SunEditor: Critical XSS vulnerability - sanitizer bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59167",
    "datePublished": "2026-09-23T13:52:56.747Z",
    "dateReserved": "2026-07-02T16:50:27.887Z",
    "dateUpdated": "2026-09-24T14:52:33.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54606 (GCVE-0-2026-54606)

Vulnerability from nvd – Published: 2026-08-26 15:25 – Updated: 2026-08-26 18:28

Title

SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

Summary

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 18:27 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	x_refsource_CONFIRM
https://github.com/JiHong88/suneditor/issues/1649	x_refsource_MISC
https://github.com/JiHong88/suneditor/commit/9d43…	x_refsource_MISC
https://github.com/JiHong88/suneditor/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
JiHong88	suneditor	Affected: < 3.1.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54606",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:27:34.362571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T18:28:06.384Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T15:25:58.083Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/issues/1649",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/issues/1649"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/releases/tag/3.1.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/releases/tag/3.1.4"
        }
      ],
      "source": {
        "advisory": "GHSA-w93q-cq9w-58p7",
        "discovery": "UNKNOWN"
      },
      "title": "SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54606",
    "datePublished": "2026-08-26T15:25:58.083Z",
    "dateReserved": "2026-06-15T19:45:23.540Z",
    "dateUpdated": "2026-08-26T18:28:06.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124494 (GCVE-0-2026-124494)

Vulnerability from cvelistv5 – Published: 2026-11-08 13:16 – Updated: 2026-11-10 17:53

Title

SunEditor before 3.4.0 Stored XSS via &colon; Entity Sanitizer Bypass

Summary

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like &colon; to an empty string. Attackers can inject href values such as javascript&colon; that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 16:26 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	vendor-advisory
https://www.vulncheck.com/advisories/suneditor-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
JiHong88	suneditor	Affected: 0 , < 3.4.0 (semver) Unaffected: 3.4.0 (semver)

Date Public

2026-10-23 00:00

Credits

1diot9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124494",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T16:26:18.573220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T17:53:45.128Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/suneditor",
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "lessThan": "3.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "1diot9"
        }
      ],
      "datePublic": "2026-10-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer\u0027s _normalizeURL() function decodes named entities like \u0026colon; to an empty string. Attackers can inject href values such as javascript\u0026colon; that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T13:16:09.907Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-v4jx-8pj6-w4w8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-v4jx-8pj6-w4w8"
        },
        {
          "name": "VulnCheck Advisory: SunEditor before 3.4.0 Stored XSS via \u0026colon; Entity Sanitizer Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-colon-entity-sanitizer-bypass"
        }
      ],
      "title": "SunEditor before 3.4.0 Stored XSS via \u0026colon; Entity Sanitizer Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124494",
    "datePublished": "2026-11-08T13:16:09.907Z",
    "dateReserved": "2026-11-08T02:21:16.290Z",
    "dateUpdated": "2026-11-10T17:53:45.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124493 (GCVE-0-2026-124493)

Vulnerability from cvelistv5 – Published: 2026-11-08 13:16 – Updated: 2026-11-08 13:16

Title

SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent

Summary

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	vendor-advisory
https://www.vulncheck.com/advisories/suneditor-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
JiHong88	suneditor	Affected: 0 , < 3.4.0 (semver) Unaffected: 3.4.0 (semver)

Date Public

2026-10-23 00:00

Credits

iElloc

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "lessThan": "3.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "iElloc"
        }
      ],
      "datePublic": "2026-10-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T13:16:09.204Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-h9pq-57qf-vvfh)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-h9pq-57qf-vvfh"
        },
        {
          "name": "VulnCheck Advisory: SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-documenttype-header-textcontent"
        }
      ],
      "title": "SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124493",
    "datePublished": "2026-11-08T13:16:09.204Z",
    "dateReserved": "2026-11-08T02:21:16.290Z",
    "dateUpdated": "2026-11-08T13:16:09.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124492 (GCVE-0-2026-124492)

Vulnerability from cvelistv5 – Published: 2026-11-08 13:16 – Updated: 2026-11-08 13:16

Title

SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List

Summary

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	vendor-advisory
https://www.vulncheck.com/advisories/suneditor-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
JiHong88	suneditor	Affected: 0 , < 3.4.0 (semver) Unaffected: 3.4.0 (semver)

Date Public

2026-10-23 00:00

Credits

iElloc

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "lessThan": "3.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "iElloc"
        }
      ],
      "datePublic": "2026-10-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor\u0027s #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T13:16:08.514Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5pp5-5qrp-vq56)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-5pp5-5qrp-vq56"
        },
        {
          "name": "VulnCheck Advisory: SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-link-modal-bookmark-list"
        }
      ],
      "title": "SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124492",
    "datePublished": "2026-11-08T13:16:08.514Z",
    "dateReserved": "2026-11-08T02:21:16.290Z",
    "dateUpdated": "2026-11-08T13:16:08.514Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124491 (GCVE-0-2026-124491)

Vulnerability from cvelistv5 – Published: 2026-11-08 13:16 – Updated: 2026-11-09 14:18

Title

SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename

Summary

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 14:17 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	vendor-advisory
https://www.vulncheck.com/advisories/suneditor-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
JiHong88	suneditor	Affected: 0 , < 3.4.0 (semver) Unaffected: 3.4.0 (semver)

Date Public

2026-10-23 00:00

Credits

iElloc

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124491",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T14:17:52.580928Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T14:18:21.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-2w4v-r3v4-f5h4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "lessThan": "3.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "iElloc"
        }
      ],
      "datePublic": "2026-10-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims\u0027 browsers when content or gallery items load, enabling session theft."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T13:16:07.817Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2w4v-r3v4-f5h4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-2w4v-r3v4-f5h4"
        },
        {
          "name": "VulnCheck Advisory: SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-fileupload-plugin-filename"
        }
      ],
      "title": "SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124491",
    "datePublished": "2026-11-08T13:16:07.817Z",
    "dateReserved": "2026-11-08T02:21:16.290Z",
    "dateUpdated": "2026-11-09T14:18:21.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124422 (GCVE-0-2026-124422)

Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-10 17:56

Title

SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder

Summary

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 16:29 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	vendor-advisory
https://github.com/JiHong88/suneditor/commit/57db…	patch
https://github.com/JiHong88/suneditor/releases/ta…	release-notes
https://github.com/JiHong88/suneditor/blob/3.3.3/…	technical-description
https://www.vulncheck.com/advisories/suneditor-3.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
jihong88	suneditor	Affected: 3.0.0 , < 3.4.0 (semver)

Date Public

2026-10-23 18:49

Credits

kemrec manus-pi EclipsSec Zachariah Mithani (AploSec)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124422",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T16:29:37.766796Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T17:56:37.271Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/suneditor",
          "product": "suneditor",
          "repo": "https://github.com/JiHong88/suneditor",
          "vendor": "jihong88",
          "versions": [
            {
              "lessThan": "3.4.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "kemrec"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "manus-pi"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "EclipsSec"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Zachariah Mithani (AploSec)"
        }
      ],
      "datePublic": "2026-10-23T18:49:04.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:41.148Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-q867-q2hw-f8gp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-q867-q2hw-f8gp"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/JiHong88/suneditor/commit/57db24ac218cd10942fed0bb8288e9cb40b334bb"
        },
        {
          "name": "suneditor 3.4.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/JiHong88/suneditor/releases/tag/3.4.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/JiHong88/suneditor/blob/3.3.3/src/core/logic/dom/html.js#L336-L350"
        },
        {
          "name": "VulnCheck Advisory: SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/suneditor-3.0.0-before-3.4.0-stored-xss-via-html-clean-iframe-placeholder"
        }
      ],
      "title": "SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124422",
    "datePublished": "2026-11-08T01:38:41.148Z",
    "dateReserved": "2026-11-08T00:57:59.205Z",
    "dateUpdated": "2026-11-10T17:56:37.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59167 (GCVE-0-2026-59167)

Vulnerability from cvelistv5 – Published: 2026-09-23 13:52 – Updated: 2026-09-24 14:52

Title

SunEditor: Critical XSS vulnerability - sanitizer bypass

Summary

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 14:24 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	x_refsource_CONFIRM
https://github.com/JiHong88/suneditor/issues/1646	x_refsource_MISC
https://github.com/JiHong88/suneditor/commit/a94a…	x_refsource_MISC
https://github.com/JiHong88/suneditor/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
JiHong88	suneditor	Affected: < 2.47.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59167",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T14:24:21.114425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T14:52:33.658Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.47.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application\u0027s browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T13:52:56.747Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/issues/1646",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/issues/1646"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/commit/a94ace269c7102bfb6de58a27a6547bc4eb09045",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/commit/a94ace269c7102bfb6de58a27a6547bc4eb09045"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/releases/tag/2.47.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/releases/tag/2.47.11"
        }
      ],
      "source": {
        "advisory": "GHSA-6rf4-v2fh-m6p4",
        "discovery": "UNKNOWN"
      },
      "title": "SunEditor: Critical XSS vulnerability - sanitizer bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59167",
    "datePublished": "2026-09-23T13:52:56.747Z",
    "dateReserved": "2026-07-02T16:50:27.887Z",
    "dateUpdated": "2026-09-24T14:52:33.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54606 (GCVE-0-2026-54606)

Vulnerability from cvelistv5 – Published: 2026-08-26 15:25 – Updated: 2026-08-26 18:28

Title

SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

Summary

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 18:27 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	x_refsource_CONFIRM
https://github.com/JiHong88/suneditor/issues/1649	x_refsource_MISC
https://github.com/JiHong88/suneditor/commit/9d43…	x_refsource_MISC
https://github.com/JiHong88/suneditor/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
JiHong88	suneditor	Affected: < 3.1.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54606",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:27:34.362571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T18:28:06.384Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T15:25:58.083Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/issues/1649",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/issues/1649"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/releases/tag/3.1.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/releases/tag/3.1.4"
        }
      ],
      "source": {
        "advisory": "GHSA-w93q-cq9w-58p7",
        "discovery": "UNKNOWN"
      },
      "title": "SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54606",
    "datePublished": "2026-08-26T15:25:58.083Z",
    "dateReserved": "2026-06-15T19:45:23.540Z",
    "dateUpdated": "2026-08-26T18:28:06.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

14 vulnerabilities by jihong88

CVE-2026-124494 (GCVE-0-2026-124494)

CVE-2026-124493 (GCVE-0-2026-124493)

CVE-2026-124492 (GCVE-0-2026-124492)

CVE-2026-124491 (GCVE-0-2026-124491)

CVE-2026-124422 (GCVE-0-2026-124422)

CVE-2026-59167 (GCVE-0-2026-59167)

CVE-2026-54606 (GCVE-0-2026-54606)

CVE-2026-124494 (GCVE-0-2026-124494)

CVE-2026-124493 (GCVE-0-2026-124493)

CVE-2026-124492 (GCVE-0-2026-124492)

CVE-2026-124491 (GCVE-0-2026-124491)

CVE-2026-124422 (GCVE-0-2026-124422)

CVE-2026-59167 (GCVE-0-2026-59167)

CVE-2026-54606 (GCVE-0-2026-54606)