by Kastro
Paper/Archive/CVE-2026-124494

CVE-2026-124494

JiHong88 suneditor — SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass

CVSS 9.3
critical.is priorityof 100
28
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.

Affected

ProductAffectedFixed inSource
suneditor< 3.4.03.4.0CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

References

advisorygithub.com/JiHong88/suneditor/security/advisories/GHSA-v4jx-8pj6-w4w8writeupvulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-colon-entity-sanitizer-bypass