Jihong88
CVE-2026-124422: SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JS
CVE-2026-124422 Nov 8, 2026 Source: Vendor
SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-124422
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
4 lines
Showing 1–4 of 4
CVE-2026-124422
BR2026-0000-043456
unclaimed
Credited as kemrec
CVE-2026-124422
BR2026-0000-043457
unclaimed
Credited as manus-pi
CVE-2026-124422
BR2026-0000-043458
unclaimed
Credited as EclipsSec
CVE-2026-124422
BR2026-0000-043459
unclaimed
Credited as Zachariah Mithani (AploSec)