Description
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.
Published: 2026-08-26
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an attacker to inject malicious script tags through the Embed plugin's handling of externally referenced scripts that follow an iframe. This script is executed in the context of the editor page, providing the attacker with the ability to read or manipulate page data, perform account actions, or exfiltrate information. The weakness is a classic DOM based XSS flaw (CWE‑79).

Affected Systems

The issue affects SunEditor by JiHong88 for all installed versions prior to 3.1.4, specifically 3.1.3 and earlier. Version 3.1.4 and above contain the fix.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity; the EPSS is not available and the vulnerability is not listed in KEV. Attackers can exploit this only if they are able to submit embed HTML that is later stored or reflected by an application, then made visible to users who view or edit that content. Based on the description, the likely attack vector is a stored or reflected XSS episode triggered by the editor; this inference is drawn from the need to supply crafted embed code and the resulting JavaScript execution in the editor page.

Generated by OpenCVE AI on August 26, 2026 at 17:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SunEditor to version 3.1.4 or later to apply the vendor’s fix.
  • If upgrading is not possible, disable or remove the Embed plugin from the editor configuration.
  • Implement server‑side sanitization that strips <script> elements and external script references from content before storing or rendering it.

Generated by OpenCVE AI on August 26, 2026 at 17:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-w93q-cq9w-58p7 SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed
History

Wed, 26 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Description SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.
Title SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-26T18:28:06.384Z

Reserved: 2026-06-15T19:45:23.540Z

Link: CVE-2026-54606

cve-icon Vulnrichment

Updated: 2026-08-26T18:27:58.915Z

cve-icon NVD

Status : Received

Published: 2026-08-26T16:16:27.890

Modified: 2026-08-26T19:16:50.920

Link: CVE-2026-54606

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T17:45:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')