Medium 6.1

SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder

CVE-2026-124422 First seen on SecPulse Nov 8, 10:38

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
jihong88	jihong88suneditor	≥ 3.0.0, < 3.4.0→ 3.4.0	3.4.0

Original description The description as published by the source.

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.1; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4: Medium 5.3; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Published: Nov 8, 2026
First seen on SecPulse: Nov 8, 10:38
GHSA: GHSA-q867-q2hw-f8gp
CWE: CWE-79

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Cross-Site Scripting

CWE

CWE-79

All

Jihong88 Suneditor

Detection sources

OSV.dev (Open Source Vulnerabilities)Nov 9, 11:47
NIST National Vulnerability Database03:17
GitHub Security Advisories (Global)Nov 8, 12:30
CVE.org (CVE Program・cvelistV5)02:56