CriticalCritical vulnerability

CVE-2026-124493 (CVSS 9.3)

NVD · officialPublished Nov 8, 2026Risk 50/100

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.

Technical details

CVSS

9.3

AV:NetworkAC:LowPR:NoneUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source