SunEditor: Stored cross-site scripting in ModalAnchorEditor (CVE-2026-124492)

SunEditor versions before 3.4.0 are vulnerable to stored cross-site scripting (XSS) within the ModalAnchorEditor component. The vulnerability resides in the #createBookmarkList function, which inserts textContent from h1-h6 tags into the bookmark list using innerHTML without appropriate sanitization or escaping. This allows an attacker to inject malicious HTML-encoded payloads into the editor headers, which execute arbitrary JavaScript when a user interacts with the link modal and initiates a search by typing '#' in the URL input field.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's session. This may lead to session hijacking, unauthorized actions performed on behalf of the user, or further compromise of the web application.

Recommendation

• Upgrade SunEditor to version 3.4.0 or later to include the necessary sanitization logic.
• Audit existing content created with the editor for h1-h6 headers containing suspicious HTML or script tags.
• Implement or strengthen Content Security Policy (CSP) headers to restrict unauthorized script execution within the application context.