{"id":"CVE-2026-124491","kind":"vulnerability","aliases":["CVE-2026-124491"],"related":[],"title":"SunEditor: uploaded file names run scripts in editor users' browsers","description":"SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.","summary":"SunEditor, a JavaScript rich-text editor, puts server-returned file names into the page without escaping them. An attacker who uploads a file with HTML in its name can run JavaScript in the browser of anyone who loads that content, which can lead to session theft.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","package","rich-text-editor","suneditor"],"not_affected_if":["no-file-upload-plugin","no-user-uploads"],"how_to_check":"- Check the installed `suneditor` version in `package.json` or the lockfile; versions below `3.4.0` are affected.\n- Check whether the FileUpload plugin is enabled in the editor configuration.","fix":"- `suneditor` upgrade to `3.4.0` or later","status":"open","published_at":"2026-11-08T14:18:18+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","triaged_at":"2026-11-08T14:50:52+00:00","updated_at":"2026-11-08T14:50:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T14:50:52Z","model":"claude-haiku-5-5","output":{"fix":"- `suneditor` upgrade to `3.4.0` or later","reach":"internet","title":"SunEditor: uploaded file names run scripts in editor users' browsers","impact":"medium","summary":"SunEditor, a JavaScript rich-text editor, puts server-returned file names into the page without escaping them. An attacker who uploads a file with HTML in its name can run JavaScript in the browser of anyone who loads that content, which can lead to session theft.","audience":"developers","category":"package","nicknames":[],"who_cares":["suneditor","javascript","rich-text-editor"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs scripts in victims' browsers and steals sessions","analyst_note":"","how_to_check":"- Check the installed `suneditor` version in `package.json` or the lockfile; versions below `3.4.0` are affected.\n- Check whether the FileUpload plugin is enabled in the editor configuration.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-file-upload-plugin","no-user-uploads"],"who_is_affected":"Sites that embed SunEditor with the FileUpload plugin and let users upload files, then show those file names to other users, are exposed. Sites that do not use the FileUpload plugin or do not accept user uploads can skip it. The sources do not say whether the server-side html.clean() bypass matters beyond the browser sink.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4619,"output_tokens":540,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124491':13A,16A '-2026':12A,15A '3.4.0':74C 'anyon':61B 'assign':90C 'attack':44B,100C 'browser':10A,59B,117C 'bypass':110C 'contain':75C 'content':65B,119C 'creat':87C 'cross':79C 'cross-sit':78C 'cve':11A,14A 'editor':8A,22B,30B 'enabl':124C 'escap':41B,99C 'execut':113C 'file':3A,35B,48B,94C,103C 'fileupload':85C 'galleri':121C 'html':50B,106C 'html-laden':105C 'html.clean':111C 'innerhtml':97C 'item':122C 'javascript':17B,26B,56B,114C 'laden':107C 'lead':68B 'load':63B,123C 'method':88C 'name':4A,36B,53B,95C,108C 'packag':18B 'page':39B 'plugin':86C 'put':31B 'return':34B,93C 'rich':20B,28B 'rich-text':27B 'rich-text-editor':19B 'run':5A,55B 'script':6A,81C 'server':33B,92C 'server-return':32B,91C 'session':70B,125C 'site':80C 'store':77C 'suneditor':1A,23B,24B,72C 'text':21B,29B 'theft':71B,126C 'upload':2A,46B,102C 'user':9A 'victim':116C 'vulner':82C 'without':40B,98C","nicknames":[],"mitigations":[],"who_affected":"Sites that embed SunEditor with the FileUpload plugin and let users upload files, then show those file names to other users, are exposed. Sites that do not use the FileUpload plugin or do not accept user uploads can skip it. The sources do not say whether the server-side html.clean() bypass matters beyond the browser sink.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["javascript","medium","package","richtexteditor","suneditor"],"campaign_type":null,"search_a":"'-124491':13A,16A '-2026':12A,15A 'browser':10A 'cve':11A,14A 'editor':8A 'file':3A 'name':4A 'run':5A 'script':6A 'suneditor':1A 'upload':2A 'user':9A","search_b":"'anyon':61B 'attack':44B 'browser':59B 'content':65B 'editor':22B,30B 'escap':41B 'file':35B,48B 'html':50B 'javascript':17B,26B,56B 'lead':68B 'load':63B 'name':36B,53B 'packag':18B 'page':39B 'put':31B 'return':34B 'rich':20B,28B 'rich-text':27B 'rich-text-editor':19B 'run':55B 'server':33B 'server-return':32B 'session':70B 'suneditor':23B,24B 'text':21B,29B 'theft':71B 'upload':46B 'without':40B","search_c":"'3.4.0':74C 'assign':90C 'attack':100C 'browser':117C 'bypass':110C 'contain':75C 'content':119C 'creat':87C 'cross':79C 'cross-sit':78C 'enabl':124C 'escap':99C 'execut':113C 'file':94C,103C 'fileupload':85C 'galleri':121C 'html':106C 'html-laden':105C 'html.clean':111C 'innerhtml':97C 'item':122C 'javascript':114C 'laden':107C 'load':123C 'method':88C 'name':95C,108C 'plugin':86C 'return':93C 'script':81C 'server':92C 'server-return':91C 'session':125C 'site':80C 'store':77C 'suneditor':72C 'theft':126C 'upload':102C 'victim':116C 'vulner':82C 'without':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-23T18:48:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124491","severity":null,"published_at":"2026-11-08T14:18:18+00:00","modified_at":"2026-11-08T14:18:18+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","fetched_at":"2026-11-08T14:48:41+00:00","note":null}],"documents":[{"id":102170,"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-2w4v-r3v4-f5h4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T18:48:05+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102171,"url":"https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-fileupload-plugin-filename","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}