Is CVE-2026-124422 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124422 being exploited in the wild.

How severe is CVE-2026-124422?

Medium severity, with a CVSS score of 6.1, published 8 November 2026.

Which products and versions are affected?

JiHong88 SunEditor 3.0.0 through 3.3.3.

Is there a fix for CVE-2026-124422?

Yes: fixed in 3.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124422 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-124422?

Check whether you run JiHong88 SunEditor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124422: SunEditor stored cross-site scripting in html.clean iframe rebuild

CVE-2026-124422 · Severity: medium · CVSS 6.1 · Published 2026-11-08

SunEditor is a web-based rich text editor used to compose HTML content. Versions 3.0.0 through 3.3.x contain a stored cross-site scripting vulnerability in the html.clean() function that fails to filter dangerous attributes when reconstructing iframes. An attacker can inject malicious scripts through paste, html.set, or html.insert operations, which execute with the privileges of the host page when victims load or edit the content.

Technologies: JiHong88 SunEditor. Vendors: JiHong88.

Quick answers

Is CVE-2026-124422 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124422 being exploited in the wild.
How severe is CVE-2026-124422?: Medium severity, with a CVSS score of 6.1, published 8 November 2026.
Which products and versions are affected?: JiHong88 SunEditor 3.0.0 through 3.3.3.
Is there a fix for CVE-2026-124422?: Yes: fixed in 3.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124422 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-124422?: Check whether you run JiHong88 SunEditor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.4.0

Technical details

The vulnerability exists in the html.clean() function which rebuilds iframes from a data-se-iframe-holder-attrs JSON field without filtering dangerous attributes like srcdoc or uppercase SRC variants. An attacker can inject crafted HTML/JSON through user-controlled input (paste, html.set, html.insert) to break out of iframe sandbox restrictions and execute arbitrary JavaScript in the page origin. The flaw affects versions 3.0.0 before 3.4.0 and requires victim interaction (load or paste action) to trigger.

Affected products

JiHong88 SunEditor 3.0.0 through 3.3.3

Timeline

2026-11-08: disclosed
2026-10-24: patched: Version 3.4.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.