CVE-2026-59167
Received Received - Intake

Stored XSS in SunEditor via Sanitizer Bypass

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-59167
EUVD
EUVD-2026-85324

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
suneditor suneditor 2.47.11
jihong88 suneditor 2.47.10
jihong88 suneditor From 2.47.11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in SunEditor versions 2.47.10 and earlier. The sanitizer fails to properly remove event-handler attributes from crafted namespaced or custom HTML elements, allowing JavaScript execution when users interact with malicious content. The issue was fixed in version 2.47.11.

Detection Guidance

To detect this vulnerability, check if your SunEditor version is 2.47.10 or earlier. Use commands like 'npm list suneditor' or inspect package.json to verify the installed version. If vulnerable, upgrade to 2.47.11 or later.

Impact Analysis

An attacker could inject malicious scripts via SunEditor content, leading to stored or reflected XSS attacks. This may result in data exposure, session theft, credential theft, or unauthorized actions in the application's browser context if users interact with the crafted content.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately upgrade SunEditor to version 2.47.11 or later. Review and update input sanitization logic in your application to ensure event-handler attributes are stripped from namespaced or custom HTML elements.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59167. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart