CVE-2026-124494 SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass
CriticalCVSS 9.3
- Published
- Updated
- Exploit status
- No public exploit known
Description
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm suneditor | < 3.4.0 | 3.4.0 |
References
- GitHub Security Advisory (GHSA-v4jx-8pj6-w4w8) vendor-advisory
- VulnCheck Advisory: SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass third-party-advisory