npm/suneditor CVE-2026-54606: high 8.5, EPSS 0.58%

SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

Action: Upgrade suneditor to 3.1.4 or later.

npm i suneditor@3.1.4

Affected

Fixed versions

Sources

• osv: GHSA-w93q-cq9w-58p7
• nvd: CVE-2026-54606
• https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7
• https://github.com/JiHong88/suneditor/issues/1649
• https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677
• https://github.com/JiHong88/suneditor
• https://github.com/JiHong88/suneditor/releases/tag/3.1.4
• https://github.com/github/advisory-database/pull/10757

CVE-2026-54606 · published 2026-08-26T15:26:24Z · modified 2026-10-30T17:15:03.854697918Z · JSON