{"id":"GHSA-6rf4-v2fh-m6p4","revision":null,"records":[{"revision":"88f523b1d64b4f879e1c09182e01cc38","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-59167","aliases":[],"title":"SunEditor: Critical XSS vulnerability - sanitizer bypass","description":"SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.","state":0,"publishedAt":"2026-09-23T13:52:56.747+00:00","modifiedAt":"2026-09-24T14:52:33.658+00:00","affected":[{"ecosystem":"Vendor product","name":"suneditor","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"JiHong88\",\n                    \"product\": \"suneditor\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.47.11\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":10,"severity":"CRITICAL"}],"references":["https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4","https://github.com/JiHong88/suneditor/issues/1646","https://github.com/JiHong88/suneditor/commit/a94ace269c7102bfb6de58a27a6547bc4eb09045","https://github.com/JiHong88/suneditor/releases/tag/2.47.11"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59167","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-59167","identifiers":["CVE-2026-59167"]},"retained":false,"historicalAffected":[]},{"revision":"e4ead9653833456392f465f32e9ccc22","observedAt":"2026-11-11T15:01:03.514+00:00","statement":{"source":"euvd","id":"EUVD-2026-85324","aliases":["CVE-2026-59167","GHSA-6rf4-v2fh-m6p4"],"title":"SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler at…","description":"SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":10,"severity":null}],"references":["https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4","https://github.com/JiHong88/suneditor/issues/1646","https://github.com/JiHong88/suneditor/commit/a94ace269c7102bfb6de58a27a6547bc4eb09045","https://github.com/JiHong88/suneditor/releases/tag/2.47.11"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85324","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 23, 2026, 1:52:56 PM","dateUpdated":"Sep 24, 2026, 2:52:33 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-85324","identifiers":["EUVD-2026-85324","CVE-2026-59167","GHSA-6rf4-v2fh-m6p4"]},"retained":false,"historicalAffected":[]},{"revision":"1277db32c5ac4c569eacb2b0d8625310","observedAt":"2026-10-25T14:19:16.843+00:00","statement":{"source":"nvd","id":"CVE-2026-59167","aliases":[],"title":"SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler at…","description":"SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.","state":0,"publishedAt":"2026-09-23T14:17:07.923+00:00","modifiedAt":"2026-09-24T15:17:25.303+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":10,"severity":"CRITICAL"}],"references":["https://github.com/JiHong88/suneditor/commit/a94ace269c7102bfb6de58a27a6547bc4eb09045","https://github.com/JiHong88/suneditor/issues/1646","https://github.com/JiHong88/suneditor/releases/tag/2.47.11","https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59167","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-79"],"productCriteria":[],"sourceDates":{"published":"2026-09-23T14:17:07.923","lastModified":"2026-09-24T15:17:25.303"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-59167","identifiers":["CVE-2026-59167"]},"retained":false,"historicalAffected":[]},{"revision":"0e3817dcc37e4a3095e512d4f7ec454b","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-6rf4-v2fh-m6p4","aliases":["CVE-2026-59167"],"title":"SunEditor: Critical XSS vulnerability - sanitizer bypass","description":"## Summary\n\nSUNEDITOR `v2.47.10` appears to allow JavaScript execution through crafted namespaced HTML elements.\n\nThe sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that executes JavaScript when the rendered element is interacted with.\n\nThis behavior was observed after the changes introduced in this commit:\n\nhttps://github.com/JiHong88/suneditor/commit/9ed405fb0de676e56cd0e6a13c19c103ad5948d3\n\n---\n\n## Affected Version\n\nConfirmed vulnerable:\n\n* SUNEDITOR =< `2.47.10`\n\nPotentially affected:\n\n* Previous versions, if the same sanitization logic is still present\n\n---\n\n## Proof of Concept\n\nThe following payload preserves an executable event handler:\n\n```html\n<a:b src=\"/x\"><iframe src=javascript:alert(1)></iframe></a:b>\n\n<p><a:b src=\"/x\" onclick=\"document.body.style.background='red'\">click</a:b></p>\n```\n\nSimplified PoC:\n\n```html\n<a:b src=\"/x\" onclick=\"console.log('XSS:',document.domain,document.cookie)\">click</a:b>\n```\n\n```html\n<p><a:b src=\"/x\" onmouseover=\"alert('XSS — '+document.domain)\">\uD83D\uDCCE Click here for solutions</a:b></p>\n```\n---\n\n## Steps to Reproduce\n\n1. Open SUNEDITOR using version `2.47.10`.\n2. Insert the payload above into the editor.\n3. Save or render the generated content.\n4. Click the generated element.\n5. Observe that JavaScript is executed.\n\n---\n\n## Impact\n\nThis may allow an attacker to inject arbitrary JavaScript into rendered editor content.\n\nDepending on how SUNEDITOR is integrated into an application, this could lead to:\n\n* Stored XSS\n* DOM manipulation\n* Session theft\n* Credential theft\n* Account takeover actions performed in the victim’s browser context\n\n---\n\n## Technical Details\n\nThe issue appears to be related to incomplete handling of namespaced/custom HTML elements such as:\n\n```html\n<a:b>\n```\n\nEvent-handler attributes such as `onclick` can remain attached to these crafted elements and execute when interacted with.\n\nThis suggests that the sanitization process may not consistently normalize and validate custom or namespaced elements before applying attribute filtering.\n\n---\n\n## Suggested Remediation\n\nPossible mitigations include:\n\n* Normalize DOM elements before sanitization.\n* Explicitly reject or unwrap unknown/custom/namespaced tags.\n* Strip all event-handler attributes from all elements, including unknown/custom elements.\n* Re-validate sanitized output after browser DOM parsing.\n* Add regression tests for namespaced/custom tag payloads.\n\n---","state":0,"publishedAt":"2026-09-24T14:57:55+00:00","modifiedAt":"2026-09-24T15:15:04.6789299+00:00","affected":[{"ecosystem":"npm","name":"suneditor","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.47.11"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4","https://nvd.nist.gov/vuln/detail/CVE-2026-59167","https://github.com/JiHong88/suneditor/issues/1646","https://github.com/JiHong88/suneditor/commit/a94ace269c7102bfb6de58a27a6547bc4eb09045","https://github.com/JiHong88/suneditor","https://github.com/JiHong88/suneditor/releases/tag/2.47.11"],"sourceUrl":"https://github.com/advisories/GHSA-6rf4-v2fh-m6p4","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6rf4-v2fh-m6p4","identifiers":["GHSA-6rf4-v2fh-m6p4","CVE-2026-59167"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T12:55:42.4262761+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T12:55:42.4262761+00:00","lastSuccessAt":"2026-11-12T12:55:42.5974366+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:55:42.5974423+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-5bccd177289498505bca058c1d1f630384f5399f00540fa3e5d47f20d2a6ab62","complete":true,"records":424657,"lastAttemptAt":"2026-11-12T12:53:35.4399876+00:00","lastSuccessAt":"2026-11-12T12:53:35.3826245+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:53:35.4399876+00:00","snapshotPublishedAt":"2026-11-12T12:31:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0580dcc98aaa46a8935f8ff576f25037","complete":true,"records":13764,"lastAttemptAt":"2026-11-12T12:56:08.7918389+00:00","lastSuccessAt":"2026-11-12T11:56:20.209+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:56:20.209+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13817,"expectedIdentifiers":13817,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T12:55:42.4262761+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T12:55:42.4262761+00:00","lastSuccessAt":"2026-11-12T12:55:42.5982202+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:55:42.5982204+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8e24d21c65544232af203e5ab569fc84","complete":false,"records":13764,"lastAttemptAt":"2026-11-12T12:56:08.0805262+00:00","lastSuccessAt":"2026-11-12T12:56:08.077+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:56:08.077+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13313,"expectedIdentifiers":13817,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T12:55:42.268774+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:55:42.268774+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T12:53:36.536519+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:53:36.536519+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f46f74c6a30a9b6e4cfb481719c6d35521ebec2d53ebf163223d093ae587eb9d","complete":true,"records":3106,"lastAttemptAt":"2026-11-12T12:55:42.3839893+00:00","lastSuccessAt":"2026-11-12T09:55:31.1176285+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:55:42.3839893+00:00","snapshotPublishedAt":"2026-11-12T09:48:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-9fe0abab1a1e38846a00931efa6f1538c21ec4cb4a790552d5b52b39478d28ca","complete":true,"records":231701,"lastAttemptAt":"2026-11-12T12:55:42.1436747+00:00","lastSuccessAt":"2026-11-12T12:55:40.1640864+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:55:42.1436747+00:00","snapshotPublishedAt":"2026-11-12T12:33:30+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}