SUNEDITOR · CVE-2026-124492 · Package
NO FIX YET · SEE WHAT TO DO
SunEditor, a rich-text editor library, inserts header text into its bookmark list without escaping it, so HTML stored in editor headers runs as script. An attacker who plants a payload in a header gets JavaScript running in the browser of a user who opens the link modal and types # in the URL field.
first public Oct 23, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed SunEditor as their rich-text editor and let users, or untrusted content, write headers into it. A victim must open the link modal and type # in the URL input, so the risk is to other editors who view that content. Projects that do not use SunEditor or run a version 3.4.0 or later are not affected.
Not affected if not-using-suneditor, version-3.4.0-or-later
Who cares javascript, rich-text-editor, suneditor
suneditor version in package.json or the lockfile; versions before 3.4.0 are affected.ModalAnchorEditor or createBookmarkList to confirm the bundled code path is present.suneditor or later (per the NVD description: before 3.4.0 is affected).SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.4.0