Stored Cross-Site Scripting in SunEditor by JiHong88

CVE-2026-124494

What is CVE-2026-124494?

The vulnerability in SunEditor versions prior to 3.4.0 allows attackers to exploit a stored cross-site scripting flaw. This occurs due to a failure in the html.clean() sanitizer, specifically within the _normalizeURL() function, which incorrectly handles named entities like :. This mistake enables malicious actors to insert unsafe href values—such as javascript:—that pass initial safety checks. Consequently, when users click on these stored links, the browsers decode them, leading to the execution of JavaScript code, which can compromise user security.

References