CVE-2026-124493 SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent

CriticalCVSS 9.3

Published: 2026-11-08 15:16
Updated: 2026-11-08 15:16
Exploit status: No public exploit known

Description

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.

Affected products

Product	Affected versions	Fixed in
JiHong88 suneditor	< 3.4.0	3.4.0

References

GitHub Security Advisory (GHSA-h9pq-57qf-vvfh) vendor-advisory
VulnCheck Advisory: SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent third-party-advisory

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: Passive
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: None
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.