CVE-2026-124494

The SunEditor text editor (versions before 3.4.0 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause lies in the html.clean() sanitizer's _normalizeURL() function, which incorrectly decodes named entities such as : into an empty string. This allows attackers to injec...