Critical XSS Sanitizer Bypass in SunEditor via Namespaced HTML Tags (CVE-2026-59167)

A critical cross-site scripting (XSS) vulnerability has been disclosed in SunEditor, a popular open-source JavaScript WYSIWYG editor, via GitHub Security Advisory GHSA-6rf4-v2fh-m6p4 (CVE-2026-59167, CVSS 10.0). According to the advisory, versions up to and including 2.47.10 are confirmed vulnerable, with earlier versions potentially affected if they share the same sanitization logic.

What happened

The reporter states that SunEditor's HTML sanitizer fails to fully strip executable event-handler attributes (such as onclick and onmouseover) from crafted namespaced or custom HTML elements, for example <a:b>. A public proof-of-concept payload demonstrates that content like <a:b>click</a:b> can survive sanitization and execute arbitrary JavaScript when a user interacts with the rendered element. The advisory attributes the behavior to changes introduced in a specific upstream commit, and notes the exploit status is currently proof-of-concept only — no in-the-wild exploitation has been reported at this time.

Why it matters

SunEditor is embedded in web applications to let users author rich-text content, so any application that renders SunEditor output without additional, independent sanitization is potentially exposed. Given the maximum CVSS score of 10.0 and public PoC availability, the practical impact depends heavily on integration: applications that render user-submitted SunEditor content to other users (e.g., comments, CMS pages, tickets) face the highest risk of stored XSS, which could lead to session/cookie theft, DOM manipulation, or actions performed in a victim's browser session.

What defenders should do now

• Inventory applications using SunEditor and identify the version in use; treat any instance at or below 2.47.10 as at-risk pending a vendor fix.
• Do not rely solely on SunEditor's built-in sanitizer for content that will be rendered to other users — apply a second, independent HTML sanitization layer (e.g., a dedicated sanitizer library with a strict allowlist) on stored or rendered output.
• Hunt for stored content containing namespaced/custom tag patterns (e.g., unusual colon-containing tag names) combined with event-handler attributes (onclick, onmouseover, onerror, etc.) in any SunEditor-backed data store.
• Monitor web application firewall and CSP violation logs for unexpected inline event-handler execution or unusual DOM element names on pages that embed SunEditor content.
• Where feasible, enforce a strict Content Security Policy that blocks inline event handlers, as defense-in-depth against sanitizer bypasses of this class.

This is developing intel based on a single GitHub Security Advisory published today; a patched release and further technical detail from the maintainer had not been confirmed at the time of writing. For full technical details, the proof-of-concept, and remediation guidance, see the original advisory: GHSA-6rf4-v2fh-m6p4.