SUNEDITOR · CVE-2026-124493 · Package
NO FIX YET · SEE WHAT TO DO
SunEditor, a browser rich-text editor library, injects header text into the page without escaping it, so HTML stored in h1-h6 headers runs as script when an editor in document:header mode loads. An attacker can steal session cookies from anyone who opens the stored content.
first public Oct 23, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed SunEditor and let users write or store content with headers in document:header mode are exposed, because stored markup executes for every editor that loads it. Apps that do not use the editor, or that do not use document:header mode, are less exposed. unknown for anything beyond that.
Not affected if document-header-mode-unused, no-suneditor
Who cares javascript, suneditor, web-editor
suneditor version in package.json and the lockfile.document:header or the SunEditor DocumentType plugin use.3.4.0 or later, per the advisory the sources reference.SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.