cyfenced.com →

[ CVE-2026-59167 · Published 23 Sep 2026 ]

SunEditor: Critical XSS vulnerability - sanitizer bypass

CVSS 10.0 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)
  • Critical severity: CVSS 10.0

[ Description ]Official description

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.

[ Fixes ]Fixes and patches

  • suneditor 2.47.11Fixed version · GitHub Advisories · npm package suneditor: upgrade to 2.47.11 or later (affected <= 2.47.10)

[ Packages ]Affected open-source packages

[ References ]References