Executive brief
SunEditor is a popular JavaScript-based rich text editor used to create and edit formatted content on web pages. The Embed plugin, which allows users to insert iframes and other embeds, contains a vulnerability that allows attackers to inject and execute arbitrary JavaScript code. An attacker who can craft or store malicious embed HTML can execute code in the browsers of any user who later opens or edits that content, potentially leading to account compromise, data theft, or unauthorized actions.
Technical details
The vulnerability is a DOM-based XSS in the Embed plugin's script element handling. The root cause is in the embed parsing logic which uses DOMParser to parse attacker-controlled HTML, then recreates and appends script elements found in the parsed content to the live DOM using dom.utils.createElement(). When a script element with a src attribute is encountered after a valid iframe, the plugin instantiates a new script element with the attacker-controlled src and appends it to the cover element, causing automatic script execution. Exploitation requires the ability to insert or store embed HTML through the editor (which may require low privileges depending on application architecture) and a user to subsequently open or render that content. An attacker achieves arbitrary JavaScript execution in the victim's browser context, enabling session hijacking, data exfiltration, or content modification. The vulnerability is patched in SunEditor version 3.1.4; versions 3.1.3 and earlier are affected.
Affected products
- JiHong88 SunEditor <= 3.1.3
Timeline
- 2026-08-26: disclosed: Advisory published to GitHub Advisory Database
- 2026-06-20: patched: Patched version 3.1.4 released