CVE-2026-124491 · Package
NO FIX YET · SEE WHAT TO DO
SunEditor, a JavaScript rich-text editor, puts server-returned file names into the page without escaping them. An attacker who uploads a file with HTML in its name can run JavaScript in the browser of anyone who loads that content, which can lead to session theft.
first public Oct 23, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites that embed SunEditor with the FileUpload plugin and let users upload files, then show those file names to other users, are exposed. Sites that do not use the FileUpload plugin or do not accept user uploads can skip it. The sources do not say whether the server-side html.clean() bypass matters beyond the browser sink.
Not affected if no-file-upload-plugin, no-user-uploads
Who cares javascript, rich-text-editor, suneditor
suneditor version in package.json or the lockfile; versions below 3.4.0 are affected.suneditor upgrade to 3.4.0 or laterSunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.