CVE-2026-124494: SunEditor before 3.4.0 Stored XSS via &colon; Entity Sanitizer Bypass

Published Nov 8, 2026

Updated

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's normalizeURL() function decodes named entities like &colon; to an empty string. Attackers can inject href values such as javascript&colon; that pass the isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:16 PM

Data Sourced

via MITRE·01:16 PM

DescriptionWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using SunEditor versions before 3.4.0 are exposed when untrusted users can submit content that is stored and later displayed to other users. Victims must click a stored malicious link for the injected JavaScript to execute.

What does an attacker need to exploit it?

An attacker needs the ability to place crafted HTML content into SunEditor, specifically an href value using a named colon entity such as javascript&colon;. No prior privileges are indicated, but exploitation requires user interaction because a victim must click the link.

Are links using encoded colons a useful indicator of attempted exploitation?

Yes. The described bypass uses href values containing javascript&colon;, which can pass the editor sanitizer's URL safety check and then be decoded by the browser. Stored editor content containing this pattern should be reviewed as a potential indicator.

What remediation is identified by the affected-version information?

Update SunEditor to version 3.4.0 or later. Versions before 3.4.0 are identified as affected.

CVE-2026-124494: SunEditor before 3.4.0 Stored XSS via &colon; Entity Sanitizer Bypass

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are links using encoded colons a useful indicator of attempted exploitation?

What remediation is identified by the affected-version information?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are links using encoded colons a useful indicator of attempted exploitation?

What remediation is identified by the affected-version information?