CVE-2026-124422 · Package
NO FIX YET · SEE WHAT TO DO
SunEditor, a browser rich-text editor library, rebuilds iframes from attribute JSON in html.clean() without filtering srcdoc or uppercase SRC keys. An attacker can inject HTML through paste, html.set or html.insert that runs script in the host page when a victim loads or pastes it.
first public Oct 23, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed SunEditor version 3.0.0 up to but not including 3.4.0 and store or redisplay rich text that other users see. Apps that use the editor only for private input or do not persist its HTML are less exposed. Exploitation requires a victim to load or paste the crafted content.
Not affected if no-user-generated-html, version-3.4.0-or-later
Who cares frontend, javascript, suneditor
suneditor package in package.json or the lockfile and read its version.suneditor 3.4.0 (fixed in 3.4.0 per the affected range: 3.0.0 before 3.4.0)SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.