Read the docs
TI-2026-86759 Aliases CVE-2026-124422GHSA-fvm2-c629-pcjf

Stored cross-site scripting in SunEditor via html.clean()

Priority LOW 39CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting flaw in html.clean() (CWE-79). The function rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. An attacker can inject crafted HTML through paste, html.set, or html.insert, which runs script in the host page origin when a victim loads or pastes the content.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.

Why it matters now

Fix Fixed suneditor (jihong88): 3.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JiHong88suneditor3.0.0 to before 3.4.03.4.0Patch availableCNA
  • suneditor VendorJiHong88 Affected 3.0.0 to before 3.4.0 Fixed in 3.4.0 Patch available CNA

Remediation

Upgrade jihong88 SunEditor to version 3.4.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

  • Fix · CNA suneditor (jihong88) Fixed in 3.4.0

Timeline

  1. 2026-11-08 Threatist record created from CVE-2026-124422
  2. 2026-11-08 Alias added: GHSA-fvm2-c629-pcjf

References

Patch 1

Advisory 1

Other 2

  • TI-2026-42328 SunEditor: Critical XSS vulnerability - sanitizer bypass CVSS 3.1CRITICAL 10.0
  • TI-2026-39439 SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed CVSS 4.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences