Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

SunEditor can let attackers run code in the browser

CVE-2026-59167 · published 26 days ago
Summary

The SunEditor web editor (versions before 2.47.11) does not always strip out custom HTML tags, so malicious code can remain in content that the editor saves. When a user later views or interacts with that content, the hidden code can run in their browser, potentially exposing data or performing actions on their behalf. Update SunEditor to version 2.47.11 or later to fix the issue.

What to do
  • Update suneditor to version 2.47.11.
Affected software
Ecosystem VendorProductAffected versions
– jihong88 suneditor < 2.47.11
npm – suneditor <= 2.47.10
< 2.47.11
Fix: upgrade to 2.47.11
Original advisory text
SunEditor: Critical XSS vulnerability - sanitizer bypass
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published23 Sep 2026
Updated19 Oct 2026
First seen23 Sep 2026
Sources
CVE-2026-59167 · NVD
CVE-2026-59167 · MITRE
GHSA-6rf4-v2fh-m6p4 · GHSA
CVE-2026-59167 · OSV
GHSA-6rf4-v2fh-m6p4 · OSV
Track software like this
Free during beta