{"id":"CVE-2026-124494","kind":"vulnerability","aliases":["CVE-2026-124494"],"related":[],"title":"SunEditor: stored XSS via sanitizer entity decoding bypass","description":"SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.","summary":"SunEditor, a rich-text editor library, has a flaw where its html.clean() sanitizer decodes named entities such as : to an empty string, letting attackers store javascript: links that pass the safety check. When a victim clicks a stored link, the attacker's JavaScript runs in their browser.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"suneditor","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["javascript","package","user-generated-content","web-apps"],"not_affected_if":["no-suneditor","trusted-authors-only"],"how_to_check":"- Check the installed SunEditor version in the project's `package.json` or lockfile, looking for versions below `3.4.0`\n- Search the codebase for `suneditor` to find where the editor and its `html.clean()` sanitizer are used","fix":"- SunEditor: move to `3.4.0` or later","status":"open","published_at":"2026-11-08T14:18:19+00:00","first_seen_at":"2026-11-08T14:48:42+00:00","triaged_at":"2026-11-08T14:50:52+00:00","updated_at":"2026-11-08T14:50:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T14:50:52Z","model":"claude-haiku-5-5","output":{"fix":"- SunEditor: move to `3.4.0` or later","reach":"internet","title":"SunEditor: stored XSS via sanitizer entity decoding bypass","impact":"medium","summary":"SunEditor, a rich-text editor library, has a flaw where its html.clean() sanitizer decodes named entities such as : to an empty string, letting attackers store javascript: links that pass the safety check. When a victim clicks a stored link, the attacker's JavaScript runs in their browser.","audience":"developers","category":"package","nicknames":[],"who_cares":["javascript","web-apps","user-generated-content"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker's JavaScript runs in victims' browsers via stored links","analyst_note":"","how_to_check":"- Check the installed SunEditor version in the project's `package.json` or lockfile, looking for versions below `3.4.0`\n- Search the codebase for `suneditor` to find where the editor and its `html.clean()` sanitizer are used","plain_action":"","product_name":"suneditor","needs_analyst":false,"not_affected_if":["no-suneditor","trusted-authors-only"],"who_is_affected":"Applications that embed SunEditor and let users author or store HTML content with links, where stored content is later rendered to other users. Sites that do not use SunEditor, or that only show content authored by trusted staff, face less exposure. unknown whether other sanitizer paths are affected.","user_interaction":"yes","product_ecosystem":"npm","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000745,"input_tokens":4624,"output_tokens":565,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124494':11A,14A '-2026':10A,13A '3.4.0':75C 'app':24B 'attack':49B,66B,99C 'browser':72B,116C 'bypass':8A 'check':57B,111C 'click':61B,121C 'contain':76C 'content':21B 'cross':80C 'cross-sit':79C 'cve':9A,12A 'decod':7A,39B,91C,114C 'editor':30B 'empti':46B,97C 'entiti':6A,41B,93C 'execut':117C 'flaw':34B 'function':90C 'generat':20B 'href':102C 'html.clean':37B,86C 'inject':101C 'issafeurl':110C 'javascript':16B,51B,68B,106C,118C 'let':48B 'librari':31B 'like':94C 'link':52B,64B,123C 'name':40B,92C 'normalizeurl':89C 'packag':17B 'pass':54B,108C 'rich':28B 'rich-text':27B 'run':69B 'safeti':56B 'sanit':5A,38B,87C 'script':82C 'site':81C 'store':2A,50B,63B,78C,122C 'string':47B,98C 'suneditor':1A,15A,25B,73C 'text':29B 'user':19B 'user-generated-cont':18B 'valu':103C 'via':4A 'victim':60B,120C 'vulner':83C 'web':23B 'web-app':22B 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Applications that embed SunEditor and let users author or store HTML content with links, where stored content is later rendered to other users. Sites that do not use SunEditor, or that only show content authored by trusted staff, face less exposure. unknown whether other sanitizer paths are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["suneditor"],"ptokens":["suneditor"],"labels":["critical","javascript","npm","package","usergeneratedcontent","webapps"],"campaign_type":null,"search_a":"'-124494':11A,14A '-2026':10A,13A 'bypass':8A 'cve':9A,12A 'decod':7A 'entiti':6A 'sanit':5A 'store':2A 'suneditor':1A,15A 'via':4A 'xss':3A","search_b":"'app':24B 'attack':49B,66B 'browser':72B 'check':57B 'click':61B 'content':21B 'decod':39B 'editor':30B 'empti':46B 'entiti':41B 'flaw':34B 'generat':20B 'html.clean':37B 'javascript':16B,51B,68B 'let':48B 'librari':31B 'link':52B,64B 'name':40B 'packag':17B 'pass':54B 'rich':28B 'rich-text':27B 'run':69B 'safeti':56B 'sanit':38B 'store':50B,63B 'string':47B 'suneditor':25B 'text':29B 'user':19B 'user-generated-cont':18B 'victim':60B 'web':23B 'web-app':22B","search_c":"'3.4.0':75C 'attack':99C 'browser':116C 'check':111C 'click':121C 'contain':76C 'cross':80C 'cross-sit':79C 'decod':91C,114C 'empti':97C 'entiti':93C 'execut':117C 'function':90C 'href':102C 'html.clean':86C 'inject':101C 'issafeurl':110C 'javascript':106C,118C 'like':94C 'link':123C 'name':92C 'normalizeurl':89C 'pass':108C 'sanit':87C 'script':82C 'site':81C 'store':78C,122C 'string':98C 'suneditor':73C 'valu':103C 'victim':120C 'vulner':83C","cause_entry":null,"cause_path":null,"first_public_at":"2026-10-23T18:49:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124494","severity":null,"published_at":"2026-11-08T14:18:19+00:00","modified_at":"2026-11-08T14:18:19+00:00","first_seen_at":"2026-11-08T14:48:42+00:00","fetched_at":"2026-11-08T14:48:42+00:00","note":null}],"documents":[{"id":102176,"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-v4jx-8pj6-w4w8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T18:49:16+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102177,"url":"https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-colon-entity-sanitizer-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}