CVE-2026-59167: SunEditor: Critical XSS vulnerability - sanitizer bypass
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SunEditorto a version that resolves this vulnerability.Fixed in 2.47.11
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using SunEditor versions before 2.47.11 are exposed if they render attacker-controlled editor content. The impact occurs in the browser origin of the application rendering that content.
What must an attacker do to exploit the vulnerability?
An attacker must cause crafted content containing namespaced or custom HTML elements with retained event-handler attributes to be stored or otherwise rendered by the application. A user must then interact with the crafted element for the handler to execute.
Are users affected merely by viewing malicious editor content?
The available information specifies that script execution occurs when a user interacts with the crafted element. It does not state that passive viewing alone triggers execution.
What version resolves the issue?
Upgrade SunEditor to version 2.47.11, which fixes the inconsistent sanitizer handling of namespaced and custom HTML elements.