CVE-2026-124492 SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List

High 8.3 Published 8 Nov 2026 Updated 8 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-124492?

CVE-2026-124492 is a high-severity vulnerability in JiHong88 suneditor, published on 8 Nov 2026.

Official description

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input.

Weakness: CWE-79

Which versions are affected by CVE-2026-124492?

How do I fix CVE-2026-124492?

No fix has been published for CVE-2026-124492 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-124492 being exploited?

There is no known exploitation of CVE-2026-124492 in the wild and no public exploit code.

Sources

Also known as GHSA-5pp5-5qrp-vq56, GHSA-h8r9-r2r8-gxj7.