CVE-2026-59167

SunEditor, a dependency-free vanilla JavaScript WYSIWYG editor, fails to consistently strip namespaced and custom HTML elements in the sanitizer within src/lib/core.js, allowing event-handler attributes (e.g., on*-style handlers) to survive sanitization on crafted elements. An attacker who can submit editor content that the application later renders can plant a payload that executes script in the victim's browser origin when the user interacts with the affected element, enabling stored cross-site scripting, session/data theft, or unauthorized actions in the user's browser context. Any application built on SunEditor versions prior to 2.47.11 that renders attacker-controlled editor content is affected; note that exploitation depends on the host application rendering untrusted input and on user interaction with the crafted element. The issue is patched in version 2.47.11. There is no known public proof of concept, it is not on the CISA KEV list, and no exploitation in the wild has been reported, though the CVSS 3.1 base score of 10.0 reflects maximal impact if exploited.

What to do: Upgrade SunEditor to 2.47.11 or later in every application that embeds it. Until patched, apply a secondary server-side sanitizer (e.g., DOMPurify) to editor content at render time and audit stored content for namespaced/custom elements carrying on* attributes. Verify whether your application renders untrusted or user-submitted editor output, since that is the deployment pattern that makes this flaw exploitable.