Executive brief
SCEditor is a popular JavaScript-based HTML and BBCode editor used in web applications. The vulnerability allows an attacker who can control SCEditor's configuration settings to inject and execute malicious JavaScript in users' browsers. This could enable account takeover, session hijacking, or theft of sensitive information from the affected web application, though it requires the attacker to have some ability to influence how SCEditor is initialized.
Technical details
SCEditor is vulnerable to DOM-based XSS (CWE-79) due to insufficient sanitization of configuration options passed to the sceditor.create() function. The vulnerability lies in how emoticon URLs and other configuration parameters (charset, style) are processed without proper validation. An attacker who can control these configuration options (e.g., through a configuration endpoint or if the application allows user-supplied configuration) can inject malicious payloads such as 'x" onerror="window.__xss=true' in emoticon URLs. The attack vector is network-based and requires low privileges plus user interaction. The fix, released in version 3.2.1, adds DOMPurify-based sanitization to validate configuration values and uses URI scheme validation matching DOMPurify's regex patterns to filter dangerous URIs.
Affected products
- SCEditor SCEditor before 3.2.1
Timeline
- 2026-02-06: disclosed
- 2026-02-06: patched: Version 3.2.1 released with sanitization fixes