中
6.1
SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder
CVE-2026-124422
SecPulse初出
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| jihong88suneditor |
3.0.0 以上 3.4.0 未満→ 3.4.0 |
3.4.0 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.
出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
参照URL
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web github.com