CVE-2026-124494

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean sanitizer's normalizeURL function decodes named entities like to an empty string. Attackers can inject href values such as javascript that pass the isSafeURL check but are decoded by browsers,...