Threats tagged 'ghsa-cm78-x5pp-rjx2'

SunEditor versions before 3.4.0 have a stored cross-site scripting (XSS) vulnerability. This occurs because the html.clean() sanitizer's _normalizeURL() function improperly decodes named entities like : to an empty string. As a result, attackers can inject href attributes with values such as javascript: that bypass the _isSafeURL() check but are decoded by browsers, leading to JavaScript execution when users click the stored links.