PT-2026-140005

CVE-2026-124492

Published

2026-11-08

Updated

2026-11-08

Description by

CVSS 4.0

8.3

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 3.4.0

Description A stored cross-site scripting issue exists in the ModalAnchorEditor component within the #createBookmarkList function. The software inserts entity-decoded text content from h1-h6 headers into the bookmark list using innerHTML without proper escaping. This allows an attacker to store HTML-encoded payloads in editor headers that execute JavaScript when a user opens the link modal and enters a # character in the URL input field.

Recommendations Update to version 3.4.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-124492