{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/suneditor--3.4.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:suneditor:suneditor:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.6,"id":"CVE-2026-124492"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SunEditor (\u003c 3.4.0)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","stored-xss"],"_cs_type":"advisory","_cs_vendors":["SunEditor"],"content_html":"\u003cp\u003eSunEditor versions before 3.4.0 are vulnerable to stored cross-site scripting (XSS) within the ModalAnchorEditor component. The vulnerability resides in the #createBookmarkList function, which inserts textContent from h1-h6 tags into the bookmark list using innerHTML without appropriate sanitization or escaping. This allows an attacker to inject malicious HTML-encoded payloads into the editor headers, which execute arbitrary JavaScript when a user interacts with the link modal and initiates a search by typing '#' in the URL input field.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's session. This may lead to session hijacking, unauthorized actions performed on behalf of the user, or further compromise of the web application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade SunEditor to version 3.4.0 or later to include the necessary sanitization logic.\u003c/li\u003e\n\u003cli\u003eAudit existing content created with the editor for h1-h6 headers containing suspicious HTML or script tags.\u003c/li\u003e\n\u003cli\u003eImplement or strengthen Content Security Policy (CSP) headers to restrict unauthorized script execution within the application context.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:37:01Z","date_published":"2026-11-08T15:37:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-suneditor-xss/","summary":"SunEditor versions prior to 3.4.0 contain a stored cross-site scripting vulnerability in the ModalAnchorEditor component that allows execution of arbitrary JavaScript via unsanitized header content.","title":"SunEditor: Stored cross-site scripting in ModalAnchorEditor (CVE-2026-124492)","url":"https://feed.craftedsignal.io/briefs/2026-11-suneditor-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - SunEditor (\u003c 3.4.0)","version":"https://jsonfeed.org/version/1.1"}