CVE-2026-54606: SunEditor Embed Plugin DOM XSS via external script element

CVE-2026-54606 · Severity: high · CVSS 4 · Published 2026-08-26

SunEditor is a popular JavaScript-based rich text editor used to create and edit formatted content on web pages. The Embed plugin, which allows users to insert iframes and other embeds, contains a vulnerability that allows attackers to inject and execute arbitrary JavaScript code. An attacker who can craft or store malicious embed HTML can execute code in the browsers of any user who later opens or edits that content, potentially leading to account compromise, data theft, or unauthorized actions.

Vendors: npm.

Quick answers

Is CVE-2026-54606 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54606 being exploited in the wild.
How severe is CVE-2026-54606?
High severity, with a CVSS score of 4, published 26 August 2026.
Which products and versions are affected?
suneditor (npm) <= 3.1.3, SEMVER:introduced=0,fixed=3.1.4.
Is there a fix for CVE-2026-54606?
Yes. suneditor (npm): upgrade to 3.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54606 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54606?
Check whether you run suneditor (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • suneditor (npm): upgrade to 3.1.4 or later
    npm install suneditor@3.1.4

Technical details

The vulnerability is a DOM-based XSS in the Embed plugin's script element handling. The root cause is in the embed parsing logic which uses DOMParser to parse attacker-controlled HTML, then recreates and appends script elements found in the parsed content to the live DOM using dom.utils.createElement(). When a script element with a src attribute is encountered after a valid iframe, the plugin instantiates a new script element with the attacker-controlled src and appends it to the cover element, causing automatic script execution. Exploitation requires the ability to insert or store embed HTML through the editor (which may require low privileges depending on application architecture) and a user to subsequently open or render that content. An attacker achieves arbitrary JavaScript execution in the victim's browser context, enabling session hijacking, data exfiltration, or content modification. The vulnerability is patched in SunEditor version 3.1.4; versions 3.1.3 and earlier are affected.

Affected products

  • JiHong88 SunEditor <= 3.1.3

Identifiers

  • CVE-2026-54606
  • GHSA-w93q-cq9w-58p7

Timeline

  • 2026-08-26: disclosed: Advisory published to GitHub Advisory Database
  • 2026-06-20: patched: Patched version 3.1.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.