Description
SUNEDITOR v2.47.10 appears to allow JavaScript execution through crafted namespaced HTML elements.
The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that executes JavaScript when the rendered element is interacted with.
Recommendation
Update the suneditor package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.47.10
- Patched version(s): 2.47.11
References
Could your website be exposed too?
SmartScanner can check your website for SunEditor: Critical XSS vulnerability - sanitizer bypass and gives you actionable findings to investigate.
Start a free scanRelated Issues
- CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS - CVE-2026-26028
- TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - CVE-2026-47760
- MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip - CVE-2026-85061
- Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController) - CVE-2026-73427
You might also like:
See something that needs correcting? Let us knowUpdated September 24, 2026