{"id":"CVE-2026-124422","kind":"vulnerability","aliases":["CVE-2026-124422"],"related":[],"title":"SunEditor: stored XSS via iframe attributes in html.clean() before 3.4.0","description":"SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.","summary":"SunEditor, a browser rich-text editor library, rebuilds iframes from attribute JSON in html.clean() without filtering srcdoc or uppercase SRC keys. An attacker can inject HTML through paste, html.set or html.insert that runs script in the host page when a victim loads or pastes it.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frontend","javascript","package","suneditor"],"not_affected_if":["no-user-generated-html","version-3.4.0-or-later"],"how_to_check":"- Look for the `suneditor` package in `package.json` or the lockfile and read its version.\n- Confirm whether the editor accepts pasted or user-supplied HTML that is stored and shown to other users.","fix":"- `suneditor` `3.4.0` (fixed in 3.4.0 per the affected range: 3.0.0 before 3.4.0)","status":"open","published_at":"2026-11-08T02:16:57+00:00","first_seen_at":"2026-11-08T02:21:15+00:00","triaged_at":"2026-11-08T02:25:07+00:00","updated_at":"2026-11-08T02:25:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:25:07Z","model":"claude-haiku-5-5","output":{"fix":"- `suneditor` `3.4.0` (fixed in 3.4.0 per the affected range: 3.0.0 before 3.4.0)","reach":"internet","title":"SunEditor: stored XSS via iframe attributes in html.clean() before 3.4.0","impact":"medium","summary":"SunEditor, a browser rich-text editor library, rebuilds iframes from attribute JSON in html.clean() without filtering srcdoc or uppercase SRC keys. An attacker can inject HTML through paste, html.set or html.insert that runs script in the host page when a victim loads or pastes it.","audience":"developers","category":"package","nicknames":[],"who_cares":["suneditor","javascript","frontend"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in victims' browser sessions on the host page","analyst_note":"","how_to_check":"- Look for the `suneditor` package in `package.json` or the lockfile and read its version.\n- Confirm whether the editor accepts pasted or user-supplied HTML that is stored and shown to other users.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.4.0-or-later","no-user-generated-html"],"who_is_affected":"Applications that embed SunEditor version 3.0.0 up to but not including 3.4.0 and store or redisplay rich text that other users see. Apps that use the editor only for private input or do not persist its HTML are less exposed. Exploitation requires a victim to load or paste the crafted content.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00072,"input_tokens":4342,"output_tokens":572,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124422':13A,16A '-2026':12A,15A '3.0.0':68C '3.4.0':10A,70C 'attack':44B,99C 'attr':90C 'attribut':6A,32B 'browser':23B 'contain':71C 'content':123C 'craft':102C 'cross':75C 'cross-sit':74C 'cve':11A,14A 'data':86C 'data-se-iframe-holder-attr':85C 'editor':27B 'execut':110C 'filter':37B,93C 'frontend':17B 'holder':89C 'host':58B,114C 'html':47B,103C 'html.clean':8A,35B,80C 'html.insert':52B,108C 'html.set':50B,106C 'ifram':5A,30B,83C,88C 'inject':46B,101C 'javascript':18B 'json':33B,91C 'key':42B,98C 'librari':28B 'load':63B,119C 'origin':116C 'packag':19B 'page':59B,115C 'past':49B,65B,105C,121C 'rebuild':29B,82C 'rich':25B 'rich-text':24B 'run':54B 'script':55B,77C,111C 'se':87C 'site':76C 'src':41B,97C 'srcdoc':38B,94C 'store':2A,73C 'suneditor':1A,20B,21B,66C 'text':26B 'uppercas':40B,96C 'via':4A 'victim':62B,118C 'vulner':78C 'without':36B,92C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Applications that embed SunEditor version 3.0.0 up to but not including 3.4.0 and store or redisplay rich text that other users see. Apps that use the editor only for private input or do not persist its HTML are less exposed. Exploitation requires a victim to load or paste the crafted content.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frontend","javascript","medium","package","suneditor"],"campaign_type":null,"search_a":"'-124422':13A,16A '-2026':12A,15A '3.4.0':10A 'attribut':6A 'cve':11A,14A 'html.clean':8A 'ifram':5A 'store':2A 'suneditor':1A 'via':4A 'xss':3A","search_b":"'attack':44B 'attribut':32B 'browser':23B 'editor':27B 'filter':37B 'frontend':17B 'host':58B 'html':47B 'html.clean':35B 'html.insert':52B 'html.set':50B 'ifram':30B 'inject':46B 'javascript':18B 'json':33B 'key':42B 'librari':28B 'load':63B 'packag':19B 'page':59B 'past':49B,65B 'rebuild':29B 'rich':25B 'rich-text':24B 'run':54B 'script':55B 'src':41B 'srcdoc':38B 'suneditor':20B,21B 'text':26B 'uppercas':40B 'victim':62B 'without':36B","search_c":"'3.0.0':68C '3.4.0':70C 'attack':99C 'attr':90C 'contain':71C 'content':123C 'craft':102C 'cross':75C 'cross-sit':74C 'data':86C 'data-se-iframe-holder-attr':85C 'execut':110C 'filter':93C 'holder':89C 'host':114C 'html':103C 'html.clean':80C 'html.insert':108C 'html.set':106C 'ifram':83C,88C 'inject':101C 'json':91C 'key':98C 'load':119C 'origin':116C 'page':115C 'past':105C,121C 'rebuild':82C 'script':77C,111C 'se':87C 'site':76C 'src':97C 'srcdoc':94C 'store':73C 'suneditor':66C 'uppercas':96C 'victim':118C 'vulner':78C 'without':92C","first_public_at":"2026-10-23T18:49:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124422","severity":null,"published_at":"2026-11-08T02:16:57+00:00","modified_at":"2026-11-08T02:16:57+00:00","first_seen_at":"2026-11-08T02:21:15+00:00","fetched_at":"2026-11-08T02:21:15+00:00","note":null}],"documents":[{"id":99386,"url":"https://github.com/JiHong88/suneditor/commit/57db24ac218cd10942fed0bb8288e9cb40b334bb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":99387,"url":"https://github.com/JiHong88/suneditor/releases/tag/3.4.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":99388,"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-q867-q2hw-f8gp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T18:49:04+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99389,"url":"https://www.vulncheck.com/advisories/suneditor-3.0.0-before-3.4.0-stored-xss-via-html-clean-iframe-placeholder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}