CVE-2026-124422

Name of the Vulnerable Software and Affected Versions SunEditor versions 3.0.0 through 3.3.x

Description A stored cross-site scripting issue exists in the html.clean() function. The problem occurs when iframes are rebuilt from data-se-iframe-holder-attrs JSON without properly filtering the srcdoc or uppercase SRC keys. This allows attackers to inject malicious HTML via paste, html.set, or html.insert operations, leading to script execution in the host page origin when a user loads or pastes the affected content.

Recommendations Update SunEditor to version 3.4.0 or later.