CVE-2026-59167: SunEditor: Critical XSS vulnerability - sanitizer bypass
SUNEDITOR v2.47.10 appears to allow JavaScript execution through crafted namespaced HTML elements.
The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that executes JavaScript when the rendered element is interacted with.
This behavior was observed after the changes introduced in this commit:
https://github.com/JiHong88/suneditor/commit/9ed405fb0de676e56cd0e6a13c19c103ad5948d3
References
- github.com/JiHong88/suneditor/commit/a94ace269c7102bfb6de58a27a6547bc4eb09045
- github.com/JiHong88/suneditor/issues/1646
- github.com/JiHong88/suneditor/releases/tag/2.47.11
- github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4
- github.com/advisories/GHSA-6rf4-v2fh-m6p4
- nvd.nist.gov/vuln/detail/CVE-2026-59167
Code Behaviors & Features
Detect and mitigate CVE-2026-59167 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →