CVE-2026-54606

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54606
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54606.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54606
Aliases
Published
2026-08-26T15:25:58.083Z
Modified
2026-08-28T11:47:26.916908870Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed
Details

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54606.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/jihong88/suneditor

Affected ranges

Type
GIT
Repo
https://github.com/jihong88/suneditor
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9d43a5e082101d2d6475cba86e0d58d7c2cf6677
Fixed
936b013921ab06c89cb55c0aff97f88ff9c117db
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.1.4"
        }
    ]
}

Affected versions

1.*
1.10.2
1.10.4
1.11.0
1.11.4
2.*
2.0.11
2.0.13
2.0.15
2.1.1
2.10.2
2.11.1
2.12.0
2.12.3
2.12.4
2.13.1
2.14.0
2.15.2
2.15.3
2.16.1
2.16.2
2.16.3
2.17.2
2.17.3
2.18.0
2.19.1
2.2.2
2.2.4
2.2.6
2.2.7
2.20.1
2.21.0
2.21.1
2.21.2
2.22.0
2.23.3
2.23.4
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.28.1
2.28.2
2.28.3
2.28.4
2.29.0
2.3.0
2.30.0
2.30.1
2.30.4
2.30.5
2.30.6
2.30.7
2.31.0
2.31.1
2.31.2
2.32.0
2.32.1
2.33.0
2.33.1
2.33.3
2.34.0
2.34.1
2.34.2
2.34.3
2.35.0
2.35.1
2.36.0
2.36.1
2.36.2
2.36.4
2.36.5
2.37.0
2.37.1
2.37.2
2.37.3
2.37.4
2.38.0
2.38.1
2.38.10
2.38.2
2.38.3
2.38.4
2.38.5
2.38.6
2.38.7
2.38.8
2.39.0
2.4.1
2.4.2
2.4.3
2.40.0
2.41.0
2.41.1
2.41.2
2.41.3
2.42.0
2.43.0
2.43.10
2.43.11
2.43.14
2.43.3
2.43.4
2.43.5
2.43.6
2.43.8
2.43.9
2.44.0
2.44.1
2.44.10
2.44.12
2.44.2
2.44.3
2.44.4
2.44.5
2.44.6
2.44.7
2.44.8
2.44.9
2.45.0
2.45.1
2.46.0
2.46.1
2.46.2
2.46.3
2.47.0
2.47.1
2.47.2
2.47.3
2.47.4
2.5.3
2.6.3
2.7.1
2.8.0
2.8.5
2.9.2
2.9.4
2.9.5
2.9.6
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.1.0
3.1.1
3.1.2
3.1.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54606.json"