Critical severityNVD Advisory· Published Nov 8, 2026

CVE-2026-124493

Description

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.

Affected products

SunEditor/SunEditorllm-fuzzy
Range: <3.4.0

Patches

Vulnerability mechanics

References

github.com/JiHong88/suneditor/security/advisories/GHSA-h9pq-57qf-vvfhnvd
www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-documenttype-header-textcontentnvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000