---
id: "CVE-2026-124422"
page: "https://infrastack.ai/live/CVE-2026-124422"
kind: "vulnerability"
aliases: ["CVE-2026-124422"]
title: "SunEditor: stored XSS via iframe attributes in html.clean() before 3.4.0"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["frontend", "javascript", "package", "suneditor"]
not_affected_if: ["no-user-generated-html", "version-3.4.0-or-later"]
published_at: "2026-11-08T02:16:57+00:00"
first_seen_at: "2026-11-08T02:21:15+00:00"
updated_at: "2026-11-08T02:25:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124422", "first_seen_at": "2026-11-08T02:21:15+00:00"}]
exploit_sources: []
---

# SunEditor: stored XSS via iframe attributes in html.clean() before 3.4.0

Link for people: https://infrastack.ai/live/CVE-2026-124422 (this .md is for agents)

SunEditor, a browser rich-text editor library, rebuilds iframes from attribute JSON in html.clean() without filtering srcdoc or uppercase SRC keys. An attacker can inject HTML through paste, html.set or html.insert that runs script in the host page when a victim loads or pastes it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the `suneditor` package in `package.json` or the lockfile and read its version.
- Confirm whether the editor accepts pasted or user-supplied HTML that is stored and shown to other users.

## Fix

- `suneditor` `3.4.0` (fixed in 3.4.0 per the affected range: 3.0.0 before 3.4.0)

## Timeline

- 2026-11-08T02:21:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124422

## Documents

- [advisory] Vendor advisory: github.com https://github.com/JiHong88/suneditor/security/advisories/GHSA-q867-q2hw-f8gp
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/suneditor-3.0.0-before-3.4.0-stored-xss-via-html-clean-iframe-placeholder
- [fix] Patch: github.com https://github.com/JiHong88/suneditor/commit/57db24ac218cd10942fed0bb8288e9cb40b334bb
- [fix] Release notes: github.com https://github.com/JiHong88/suneditor/releases/tag/3.4.0

## From the sources

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_