{"id":"CVE-2026-124492","kind":"vulnerability","aliases":["CVE-2026-124492"],"related":[],"title":"SunEditor: stored script injection through header text in link modal","description":"SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input.","summary":"SunEditor, a rich-text editor library, inserts header text into its bookmark list without escaping it, so HTML stored in editor headers runs as script. An attacker who plants a payload in a header gets JavaScript running in the browser of a user who opens the link modal and types # in the URL field.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"suneditor","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["javascript","package","rich-text-editor","suneditor"],"not_affected_if":["not-using-suneditor","version-3.4.0-or-later"],"how_to_check":"- Check the installed `suneditor` version in `package.json` or the lockfile; versions before `3.4.0` are affected.\n- Search the project for `ModalAnchorEditor` or `createBookmarkList` to confirm the bundled code path is present.","fix":"- `suneditor` `3.4.0` or later (per the NVD description: before 3.4.0 is affected).","status":"open","published_at":"2026-11-08T14:18:18+00:00","first_seen_at":"2026-11-08T14:48:42+00:00","triaged_at":"2026-11-08T14:49:20+00:00","updated_at":"2026-11-08T14:49:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T14:49:20Z","model":"claude-haiku-5-5","output":{"fix":"- `suneditor` `3.4.0` or later (per the NVD description: before 3.4.0 is affected).","reach":"internet","title":"SunEditor: stored script injection through header text in link modal","impact":"medium","summary":"SunEditor, a rich-text editor library, inserts header text into its bookmark list without escaping it, so HTML stored in editor headers runs as script. An attacker who plants a payload in a header gets JavaScript running in the browser of a user who opens the link modal and types # in the URL field.","audience":"developers","category":"package","nicknames":[],"who_cares":["sunEditor","javascript","rich-text-editor"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker script runs in a victim's editor session, reading or altering their content","analyst_note":"Confirm the affected npm package name and the exact fixed version from the vendor advisory (github.com) and VulnCheck page; whether a stored payload needs an authenticated writer is not stated.","how_to_check":"- Check the installed `suneditor` version in `package.json` or the lockfile; versions before `3.4.0` are affected.\n- Search the project for `ModalAnchorEditor` or `createBookmarkList` to confirm the bundled code path is present.","plain_action":"","product_name":"suneditor","needs_analyst":true,"not_affected_if":["not-using-suneditor","version-3.4.0-or-later"],"who_is_affected":"Applications that embed SunEditor as their rich-text editor and let users, or untrusted content, write headers into it. A victim must open the link modal and type # in the URL input, so the risk is to other editors who view that content. Projects that do not use SunEditor or run a version 3.4.0 or later are not affected.","user_interaction":"yes","product_ecosystem":"npm","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000791,"input_tokens":4634,"output_tokens":656,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124492':13A,16A '-2026':12A,15A '3.4.0':82C 'attack':52B,113C 'bookmark':37B,107C 'browser':65B 'contain':83C 'createbookmarklist':94C 'cross':87C 'cross-sit':86C 'cve':11A,14A 'decod':99C 'editor':23B,30B,46B,121C 'encod':118C 'entiti':98C 'entity-decod':97C 'escap':40B,112C 'execut':124C 'field':79B 'get':60B 'h1':101C 'h1-h6':100C 'h6':102C 'header':6A,33B,47B,59B,103C,122C 'html':43B,117C 'html-encod':116C 'inject':4A 'innerhtml':110C 'input':138C 'insert':32B,96C 'javascript':18B,61B,125C 'librari':31B 'link':9A,72B,131C 'list':38B,108C 'modal':10A,73B,132C 'modalanchoreditor':92C 'open':70B,129C 'packag':19B 'payload':56B,119C 'plant':54B 'rich':21B,28B 'rich-text':27B 'rich-text-editor':20B 'run':48B,62B 'script':3A,50B,89C 'site':88C 'store':2A,44B,85C,115C 'suneditor':1A,17A,24B,25B,80C 'text':7A,22B,29B,34B 'textcont':104C 'type':75B,134C 'url':78B,137C 'user':68B 'via':109C 'victim':128C 'vulner':90C 'without':39B,111C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed SunEditor as their rich-text editor and let users, or untrusted content, write headers into it. A victim must open the link modal and type # in the URL input, so the risk is to other editors who view that content. Projects that do not use SunEditor or run a version 3.4.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["suneditor"],"ptokens":["suneditor"],"labels":["high","javascript","npm","package","richtexteditor","suneditor"],"campaign_type":null,"search_a":"'-124492':13A,16A '-2026':12A,15A 'cve':11A,14A 'header':6A 'inject':4A 'link':9A 'modal':10A 'script':3A 'store':2A 'suneditor':1A,17A 'text':7A","search_b":"'attack':52B 'bookmark':37B 'browser':65B 'editor':23B,30B,46B 'escap':40B 'field':79B 'get':60B 'header':33B,47B,59B 'html':43B 'insert':32B 'javascript':18B,61B 'librari':31B 'link':72B 'list':38B 'modal':73B 'open':70B 'packag':19B 'payload':56B 'plant':54B 'rich':21B,28B 'rich-text':27B 'rich-text-editor':20B 'run':48B,62B 'script':50B 'store':44B 'suneditor':24B,25B 'text':22B,29B,34B 'type':75B 'url':78B 'user':68B 'without':39B","search_c":"'3.4.0':82C 'attack':113C 'bookmark':107C 'contain':83C 'createbookmarklist':94C 'cross':87C 'cross-sit':86C 'decod':99C 'editor':121C 'encod':118C 'entiti':98C 'entity-decod':97C 'escap':112C 'execut':124C 'h1':101C 'h1-h6':100C 'h6':102C 'header':103C,122C 'html':117C 'html-encod':116C 'innerhtml':110C 'input':138C 'insert':96C 'javascript':125C 'link':131C 'list':108C 'modal':132C 'modalanchoreditor':92C 'open':129C 'payload':119C 'script':89C 'site':88C 'store':85C,115C 'suneditor':80C 'textcont':104C 'type':134C 'url':137C 'via':109C 'victim':128C 'vulner':90C 'without':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-23T18:48:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124492","severity":null,"published_at":"2026-11-08T14:18:18+00:00","modified_at":"2026-11-08T14:18:18+00:00","first_seen_at":"2026-11-08T14:48:42+00:00","fetched_at":"2026-11-08T14:48:42+00:00","note":null}],"documents":[{"id":102172,"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-5pp5-5qrp-vq56","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T18:48:23+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102173,"url":"https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-link-modal-bookmark-list","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}