CVE-2026-59167

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.

• CWE-79

• https://github.com/JiHong88/suneditor/commit/a94ace269c7102bfb6de58a27a6547bc4eb09045
• https://github.com/JiHong88/suneditor/issues/1646
• https://github.com/JiHong88/suneditor/releases/tag/2.47.11
• https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4
• https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4

Published

Sep 23, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59156OpenImageIO is a toolset for reading, writing, and manipulat…6.5
• CVE-2026-59157webhookd is a minimalist webhook server that triggers shell …6.5
• CVE-2026-59160Yeger is a monorepo for npm packages maintained under the ye…8.8
• CVE-2026-59161Excelize is a Go language library for reading and writing Mi…7.5
• CVE-2026-59162Excelize is a Go language library for reading and writing Mi…7.5
• CVE-2026-59163Mnemosyne is a memory layer for artificial intelligence agen…9.1
• CVE-2026-59168Dasel is a command-line tool and library for querying, modif…6.2
• CVE-2026-5917libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built w…8.8
• CVE-2026-59173Uncontrolled Resource Consumption vulnerability in Apache Tr…7.5
• CVE-2026-59178ESPHome Device Builder Dashboard is a dashboard for the ESPH…9.8
• CVE-2026-5918Inappropriate implementation in Navigation in Google Chrome …4.3
• CVE-2026-59180Apprise is an open source library which allows you to send a…3.1