CVE-2026-59167

Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 2.47.11

Description The sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, which allows event-handler attributes to remain on crafted elements. If an application renders content controlled by an attacker and a user interacts with the element, the retained handler can execute scripts in the application's browser origin. This can lead to stored cross-site scripting (XSS), which is a technique where malicious scripts are permanently stored on a target server, data exposure, or unauthorized actions within the browser context.

Recommendations Update to version 2.47.11.