2vulnerabilities
- Critical1 (50.0%)
- High1 (50.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
suneditor
Ecosystem: npm
Downloads:
- 1CriticalAffects 1 version
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting suneditor, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-6rf4-v2fh-m6p4 | Critical | SunEditor: Critical XSS vulnerability - sanitizer bypass## Summary SUNEDITOR `v2.47.10` appears to allow JavaScript execution through crafted namespaced HTML elements. The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that executes JavaScript when the rendered element is interacted with. This behavior was observed after the changes introduced in this commit: https://github.com/JiHong88/suneditor/commit/9ed405fb0de676e56cd0e6a13c19c103ad5948d3 --- ## Affected Version Confirmed vulnerable: * SUNEDITOR =< `2.47.10` P |
| GitHub (opens in a new tab) | |
| GHSA-w93q-cq9w-58p7 | High | SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe EmbedSummary A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external <script src=...> element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing JavaScript execution in the context of the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, this can lead to stored or reflected XSS when another user opens, previews, renders, or edits the malicious content. Details The Em |
| GitHub (opens in a new tab) |
- GHSA-6rf4-v2fh-m6p4CriticalSunEditor: Critical XSS vulnerability - sanitizer bypass
< 2.47.11
## Summary SUNEDITOR `v2.47.10` appears to allow JavaScript execution through crafted namespaced HTML elements. The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that executes JavaScript when the rendered element is interacted with. This behavior was observed after the changes introduced in this commit: https://github.com/JiHong88/suneditor/commit/9ed405fb0de676e56cd0e6a13c19c103ad5948d3 --- ## Affected Version Confirmed vulnerable: * SUNEDITOR =< `2.47.10` P
CVE: CVE-2026-59167
- GHSA-w93q-cq9w-58p7HighSunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed
>= 3.0.0, < 3.1.4
Summary A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external <script src=...> element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing JavaScript execution in the context of the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, this can lead to stored or reflected XSS when another user opens, previews, renders, or edits the malicious content. Details The Em
CVE: CVE-2026-54606