Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
SUNEDITOR v2.47.10 appears to allow JavaScript execution through crafted namespaced HTML elements. The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that executes JavaScript when the rendered element is interacted with. This behavior was observed after the changes introduced in this commit: https://github.com/JiHong88/suneditor/commit/9ed405fb0de676e56cd0e6a13c19c103ad5948d3 --- Affected Version Confirmed vulnerable: SUNEDITOR =< 2.47.10 Potentially affected: Previous versions, if the same sanitization logic is still present --- Proof of Concept The following payload preserves an executable event handler: Simplified PoC: --- Steps to Reproduce 1. Open SUNEDITOR using version 2.47.10. 2. Insert the payload above into the editor. 3. Save or render the generated content. 4. Click the generated element. 5. Observe that JavaScript is executed. --- Impact…
Recommended action: Upgrade to 2.47.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing JavaScript execution in the context of the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, this can lead to stored or reflected XSS when another user opens, previews, renders, or edits the malicious content. Details The Embed plugin parses raw embed HTML and processes the resulting DOM nodes. When a element is included after a valid iframe, the plugin creates a new script element using the attacker-controlled src value and appends it to the DOM. Relevant behavior: const embedDOM = new DOMParser().parseFromString(src, 'text/html').body.children; if (/^script$/i.test(chd.nodeName)) { scriptTag = dom.utils.createElement('script', { src:…
Recommended action: Upgrade to 3.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.