CVE-2026-124494

JiHong88 suneditor

Published 8 Nov 2026 · updated 8 Nov 2026 · Received

9.3 Critical · CVSS 4.0, vulncheck.com

Description

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like &colon; to an empty string. Attackers can inject href values such as javascript&colon; that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.

References

github.com/JiHong88/suneditor/security/advisories/GHSA-v4jx-8pj6-w4w8
www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-colon-entity-sanitizer-bypass