CVE-2026-124491

CVSS 6.4 (medium) · published 2026-11-08

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.

Weakness: CWE-79

Source: NVD CVE-2026-124491

References

• https://github.com/JiHong88/suneditor/security/advisories/GHSA-2w4v-r3v4-f5h4
• https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-fileupload-plugin-filename
• https://github.com/JiHong88/suneditor/security/advisories/GHSA-2w4v-r3v4-f5h4

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.