Skip to content
OpenAdvisories

Package · npm

suneditor

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 10.0
    CVE-2026-59167

    SunEditor: Critical XSS vulnerability - sanitizer bypass

    SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain …

    JiHong88 suneditor suneditor npm
  • High 8.5
    CVE-2026-54606

    SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

    SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DO…

    JiHong88 suneditor suneditor npm