CVE-2026-124494

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean sanitizer's normalizeURL function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the isSafeURL check but are decoded by browsers,...