CVE-2026-54606: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in JiHong88 suneditor

SunEditor versions prior to 3.1.4 contain a cross-site scripting vulnerability in the Embed plugin located in src/plugins/modal/embed.js. The plugin parses attacker-controlled raw embed HTML using DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing execution of attacker-supplied JavaScript in the editor page context. If the application stores or reflects this content without further sanitization, an attacker can trigger stored or reflected XSS, potentially allowing access to page data and account actions of other users. This vulnerability is addressed in version 3.1.4 of SunEditor.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected application’s editor page. This can lead to theft of sensitive data, session hijacking, or unauthorized actions performed on behalf of the victim user. The vulnerability requires that the attacker can submit embed HTML content and that the application does not perform additional backend sanitization before storing or reflecting the content.

Upgrade SunEditor to version 3.1.4 or later, where this vulnerability is fixed. If upgrading immediately is not possible, ensure that any embed HTML content submitted by users is properly sanitized on the backend to prevent malicious script injection. Additional frontend sanitization alone is insufficient due to the vulnerability in the embed plugin’s DOM processing.