Vulnerability Description
SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/JiHong88/suneditor/blob/3.3.3/src/core/logic/dom/html.js#L336
- https://github.com/JiHong88/suneditor/commit/57db24ac218cd10942fed0bb8288e9cb40b
- https://github.com/JiHong88/suneditor/releases/tag/3.4.0
- https://github.com/JiHong88/suneditor/security/advisories/GHSA-q867-q2hw-f8gp
- https://www.vulncheck.com/advisories/suneditor-3.0.0-before-3.4.0-stored-xss-via
FAQ
What is CVE-2026-124422?
CVE-2026-124422 is a vulnerability with a CVSS score of 6.1 (MEDIUM). SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase...
How severe is CVE-2026-124422?
CVE-2026-124422 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-124422?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.