Critical XSS Sanitizer Bypass in SunEditor (CVE-2026-59167)

What happened

SunEditor's sanitizer, implemented in src/lib/core.js, does not consistently reject namespaced or custom HTML elements. As a result, event-handler attributes placed on such crafted elements can survive the sanitization process and remain embedded in editor output.

Technical cause

The root cause is an improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). The sanitizer fails to strip event-handler attributes from namespaced or custom HTML elements, leaving them intact in sanitized output.

Why it matters

When an application renders attacker-controlled SunEditor content and a user interacts with the affected element, the retained event handler can execute arbitrary script in the application's browser origin. This can enable stored cross-site scripting, exposure of sensitive data accessible to the page, or unauthorized actions performed in the user's browser session.

Who is affected

Any application that integrates SunEditor and renders editor-generated content containing attacker-controlled input is potentially affected, particularly where that content is displayed to other users.

Affected versions

All SunEditor (npm package 'suneditor') versions from 0 up to and including 2.47.10 are affected.

Fixes and mitigation

The vulnerability is fixed in SunEditor version 2.47.11. Users should update to this version to ensure the sanitizer correctly rejects namespaced and custom HTML elements carrying event-handler attributes.

Recommended action

Update the 'suneditor' npm package to version 2.47.11 as soon as possible. Until the update is applied, treat any user-supplied or externally sourced content rendered through SunEditor as potentially unsafe, and consider additional output encoding or content security policies as defense in depth.