CVE-2026-124422
Received Received - Intake

Stored XSS in SunEditor via iframe srcdoc manipulation

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124422
EUVD
EUVD-2026-119376

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jihong88 suneditor From 3.0.0 (inc) to 3.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SunEditor versions 3.0.0 to 3.4.0 have a stored cross-site scripting (XSS) flaw in the html.clean() function. The issue occurs when rebuilding iframes from JSON data without properly filtering srcdoc attributes or uppercase SRC keys. Attackers can inject malicious HTML via paste, html.set, or html.insert methods. When victims load or paste this content, scripts execute within the host page's origin.

Detection Guidance

This vulnerability involves stored XSS in SunEditor versions 3.0.0 to 3.4.0. Detection requires inspecting web applications using SunEditor for iframe handling in html.clean(). Check for unfiltered srcdoc attributes or uppercase SRC keys in iframe tags. Review pastes or inserted HTML content for suspicious scripts.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of your website. This could lead to theft of session cookies, account takeovers, or defacement of your site. Users interacting with infected content may unknowingly run malicious scripts, compromising their data or actions on your site.

Compliance Impact

This XSS vulnerability could violate GDPR by exposing user data through script execution. For HIPAA, it may compromise protected health information if scripts access or transmit such data. Compliance requires patching to prevent unauthorized script execution and data breaches.

Mitigation Strategies

Upgrade SunEditor to version 3.4.0 or later to patch the vulnerability. If upgrading is not possible, disable iframe handling in html.clean() or implement strict input validation for HTML content. Monitor for unusual iframe attributes or scripts in user-generated content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124422. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...