GHSA-6rf4-v2fh-m6p4: XSS
Summary
SUNEDITOR v2.47.10 appears to allow JavaScript execution through crafted namespaced HTML elements.
The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that executes JavaScript when the rendered element is interacted with.
This behavior was observed after the changes introduced in this commit:
https://github.com/JiHong88/suneditor/commit/9ed405fb0de676e56cd0e6a13c19c103ad5948d3
---
Affected Version
Confirmed vulnerable:
SUNEDITOR =< 2.47.10
Potentially affected:
Previous versions, if the same sanitization logic is still present
---
Proof of Concept
The following payload preserves an executable event handler:
html <a:b src="/x"><iframe src=javascript:alert(1)></iframe></a:b>
<p><a:b src="/x" onclick="document.body.style.background='red'">click</a:b></p>
Simplified PoC:
html <a:b src="/x" onclick="console.log('XSS:',document.domain,document.cookie)">click</a:b>
html <p><a:b src="/x" onmouseover="alert('XSS — '+document.domain)">📎 Click here for solutions</a:b></p> ---
Steps to Reproduce
1. Open SUNEDITOR using version 2.47.10. 2. Insert the payload above into the editor. 3. Save or render the generated content. 4. Click the generated element. 5. Observe that JavaScript is executed.
---
Impact
This may allow an attacker to inject arbitrary JavaScript into rendered editor content.
Depending on how SUNEDITOR is integrated into an application, this could lead to:
Stored XSS DOM manipulation Session theft Credential theft Account takeover actions performed in the victim’s browser context
---
Technical Details
The issue appears to be related to incomplete handling of namespaced/custom HTML elements such as:
html <a:b>
Event-handler attributes such as onclick can remain attached to these crafted elements and execute when interacted with.
This suggests that the sanitization process may not consistently normalize and validate custom or namespaced elements before applying attribute filtering.
---
Suggested Remediation
Possible mitigations include:
Normalize DOM elements before sanitization. Explicitly reject or unwrap unknown/custom/namespaced tags. Strip all event-handler attributes from all elements, including unknown/custom elements. Re-validate sanitized output after browser DOM parsing. Add regression tests for namespaced/custom tag payloads.
---
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/suneditorto a version that resolves this vulnerability.Fixed in 2.47.11 - Compensating control
Explicitly reject or unwrap unknown, custom, or namespaced HTML tags before rendering sanitized content.
- Compensating control
Normalize DOM elements before sanitization.
- Compensating control
Strip all event-handler attributes, including onclick and onmouseover, from all elements, including unknown or custom elements.
- Compensating control
Re-validate sanitized output after browser DOM parsing.
- Operational
Add regression tests for namespaced and custom tag payloads.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a way to supply crafted HTML content to SUNEDITOR. The supplied content can use namespaced elements such as a:b with event-handler attributes that survive sanitization, and JavaScript executes when the rendered element is interacted with.
Which versions should be treated as exposed?
SUNEDITOR versions 2.47.10 and earlier are confirmed vulnerable. Earlier versions may also be affected if they retain the same sanitization logic.
How can I determine whether my deployment is vulnerable?
Test the editor's sanitization of a namespaced element containing an event handler, such as <a:b src="/x" onclick="console.log('XSS')">click</a:b>. If the onclick attribute remains in the rendered output and executes after interaction, the deployment is affected.