← Back to the live CVE advisory feed

CVE-2026-59167: Product identification pending

Severity

10 (CRITICAL)

Affected versions

Before 2.47.11

Fixed version

2.47.11.

Patch status

Patched

Published

2026-09-23T14:17:07.923

Modified

2026-09-23T14:17:07.923

Why it matters

Critical vulnerability requiring immediate validation against your environment.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.

View the official NVD record for CVE-2026-59167

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.