CVE-2026-124493
Received Received - Intake

Stored XSS in SunEditor via DocumentType Header Injection

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124493
EUVD
EUVD-2026-119548

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
jihong88 suneditor to 3.4.0 (exc)
jihong88 suneditor 3.3.1
suneditor suneditor to 3.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-124493 is a stored cross-site scripting (XSS) vulnerability in SunEditor versions before 3.4.0. It occurs in the DocumentType constructor where header textContent is injected into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers, which executes JavaScript when editors using document:header mode initialize.

Detection Guidance

Check if your SunEditor version is below 3.4.0 by inspecting the library files or package.json. Look for configurations using type: 'document:header' or type: 'document:header,page' in your application code. Review stored headers in the database for entity-encoded HTML content that may execute JavaScript.

Impact Analysis

This vulnerability can lead to session cookie theft, session hijacking, proxy operations, or arbitrary actions on behalf of the victim. It requires the editor to be configured with type: 'document:header' or similar, which is not the default setting.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as session cookies, which may contain personally identifiable information (PII). This could violate GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information (PHI).

Mitigation Strategies

Upgrade SunEditor to version 3.4.0 or later immediately. Remove or sanitize any stored headers containing HTML content. Avoid using type: 'document:header' configurations. Implement strict input validation for header content to prevent XSS payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124493. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...