Suneditor
Monthly
Stored cross-site scripting in SunEditor prior to 2.47.11 allows an attacker-supplied editor payload to survive the library's built-in sanitizer and execute JavaScript in a victim's browser origin. The sanitizer in src/lib/core.js fails to consistently reject namespaced or custom HTML elements, so an event-handler attribute (for example an on-click handler) can be retained on a crafted element; when a downstream application stores content from one user and renders it to another, the handler fires on victim interaction. Exploitation therefore requires a multi-user rendering workflow plus victim interaction with the crafted element, and there is no public exploit identified at time of analysis; the 10.0 base score carried in some feeds is substantially overstated relative to the independent assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), which reflects a bounded stored-XSS impact rather than unauthenticated, no-interaction compromise.
Stored cross-site scripting in SunEditor prior to 2.47.11 allows an attacker-supplied editor payload to survive the library's built-in sanitizer and execute JavaScript in a victim's browser origin. The sanitizer in src/lib/core.js fails to consistently reject namespaced or custom HTML elements, so an event-handler attribute (for example an on-click handler) can be retained on a crafted element; when a downstream application stores content from one user and renders it to another, the handler fires on victim interaction. Exploitation therefore requires a multi-user rendering workflow plus victim interaction with the crafted element, and there is no public exploit identified at time of analysis; the 10.0 base score carried in some feeds is substantially overstated relative to the independent assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), which reflects a bounded stored-XSS impact rather than unauthenticated, no-interaction compromise.