CVE-2026-124494
SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.
| CWE | CWE-79 |
| Vendor | jihong88 |
| Product | suneditor |
| Published | Nov 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for jihong88 suneditor
Be the first to know when new unknown vulnerabilities affecting jihong88 suneditor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
JiHong88 / suneditor
0 < 3.4.0
References
Credits
1diot9