CVE-2026-54606

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.

• CWE-79

• https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677
• https://github.com/JiHong88/suneditor/issues/1649
• https://github.com/JiHong88/suneditor/releases/tag/3.1.4
• https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7
• https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7

Published

Aug 26, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54600Wallos is an open-source, self-hostable personal subscriptio…8.2
• CVE-2026-54601FastGPT is an open source AI knowledge base platform. From 4…6.3
• CVE-2026-54602FastGPT is a knowledge-based AI application platform. Prior …7.1
• CVE-2026-54603OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authoriza…8.6
• CVE-2026-54604OpenSlide is a C library for reading whole slide image files…5.3
• CVE-2026-54605OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols…7.2
• CVE-2026-54607FastGPT is a knowledge-based AI application platform. Prior …7.7
• CVE-2026-54608MythicalDash is a Pterodactyl client area. In 3.5.4-aurora a…7.1
• CVE-2026-54609QTI Neon is a minimal, game-agnostic, relay-based UDP multip…8.6
• CVE-2026-54611InstantCMS is a free and open source content management syst…5.5
• CVE-2026-54612Vvveb is a powerful and easy to use CMS with page builder to…8.8
• CVE-2026-54613Vvveb is a powerful and easy to use CMS with page builder to…5.4