{"id":"CVE-2026-124494","published":"2026-11-08T14:18:19.277","lastModified":"2026-11-10T18:17:30.787","description":"SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-v4jx-8pj6-w4w8","tags":[]},{"url":"https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-colon-entity-sanitizer-bypass","tags":[]}],"exploitRefs":[{"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-v4jx-8pj6-w4w8","tags":[]}],"hasPoc":true,"ai":null}