PT-2026-140007

CVE-2026-124494

Published

2026-11-08

Updated

2026-11-08

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 3.4.0

Description Stored cross-site scripting occurs because the normalizeURL() function within the html.clean() sanitizer incorrectly decodes named entities, such as &colon;, to an empty string. This allows attackers to bypass the isSafeURL() check by injecting href values like javascript&colon;, which browsers then decode to execute arbitrary JavaScript when a user clicks the stored link.

Recommendations Update SunEditor to version 3.4.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-124494