# CVE-2026-124492: SunEditor stored XSS in link modal bookmark list

Source: https://junglewise.ai/threats/cve-2026-124492-suneditor-before-3-4-0-contains-a-stored-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-124492 · Severity: high · CVSS 7.6 · Published 2026-11-08

SunEditor is a JavaScript rich text editor used to create and edit formatted documents in web applications. The link modal's bookmark feature fails to properly escape header text before rendering it as HTML, allowing attackers to store malicious code in document headers that executes when a user opens the link dialog and searches for internal links. This enables account compromise and data theft in applications using vulnerable SunEditor versions.

Technologies: [JiHong88 SunEditor](https://junglewise.ai/threats/technologies/jihong88-suneditor). Vendors: [JiHong88](https://junglewise.ai/threats/vendors/jihong88).

## Quick answers

**Is CVE-2026-124492 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124492 being exploited in the wild.

**How severe is CVE-2026-124492?** High severity, with a CVSS score of 7.6, published 8 November 2026.

**Which products and versions are affected?** JiHong88 SunEditor before 3.4.0.

**Is there a fix for CVE-2026-124492?** Yes: fixed in 3.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-124492 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-124492?** Check whether you run JiHong88 SunEditor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.4.0

## Technical details

The ModalAnchorEditor.#createBookmarkList method reads h1-h6 header elements' textContent (which is HTML-decoded plain text) and inserts it directly into an HTML template via innerHTML without escaping. An attacker can store HTML-encoded payloads (e.g., <img src=x onerror=alert(1)>) in editor headers; when a user opens the link modal and types # to create bookmark links, the decoded text is re-interpreted as HTML and executed. Stored XSS requires prior editor access and user interaction (opening link modal), but no authentication bypass is needed.

## Affected products

- JiHong88 SunEditor before 3.4.0

## Timeline

- 2026-10-23: disclosed
- 2026-11-08: advisory

## References

- [https://github.com/JiHong88/suneditor/security/advisories/GHSA-5pp5-5qrp-vq56](https://github.com/JiHong88/suneditor/security/advisories/GHSA-5pp5-5qrp-vq56)
- [https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-link-modal-bookmark-list](https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-link-modal-bookmark-list)

## Related threats

- [SunEditor stored XSS via HTML entity sanitizer bypass](https://junglewise.ai/threats/cve-2026-124494-suneditor-before-3-4-0-contains-a-stored-cross-site-scripting)
- [SunEditor stored cross-site scripting in DocumentType header rendering](https://junglewise.ai/threats/cve-2026-124493-suneditor-before-3-4-0-contains-a-stored-cross-site-scripting)
- [SunEditor stored cross-site scripting in FileUpload plugin](https://junglewise.ai/threats/cve-2026-124491-suneditor-before-3-4-0-contains-a-stored-cross-site-scripting)
- [SunEditor stored cross-site scripting in html.clean iframe rebuild](https://junglewise.ai/threats/cve-2026-124422-suneditor-from-3-0-0-before-3-4-0-contains-a-stored-cross-site)