{"action":"Upgrade suneditor to 3.1.4 or later.","affected":[{"fixed":"3.1.4","introduced":"3.0.0"}],"component":"suneditor","cve_ids":["CVE-2026-54606"],"ecosystem":"npm","epss":0.00581,"exploited":false,"fixed_versions":["3.1.4"],"ghsa_id":"GHSA-w93q-cq9w-58p7","id":"tcs_01M5KGEJTPMKE608BNYD5GV9ZQ","modified_at":"2026-10-30T17:15:03.854697918Z","published_at":"2026-08-26T15:26:24Z","references":["https://osv.dev/vulnerability/GHSA-w93q-cq9w-58p7","https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7","https://github.com/JiHong88/suneditor/issues/1649","https://github.com/JiHong88/suneditor/commit/9d43a5e082101d2d6475cba86e0d58d7c2cf6677","https://github.com/JiHong88/suneditor","https://github.com/JiHong88/suneditor/releases/tag/3.1.4","https://nvd.nist.gov/vuln/detail/CVE-2026-54606","https://github.com/github/advisory-database/pull/10757"],"severity":{"label":"high","score":8.5},"sources":[{"source":"osv","source_id":"GHSA-w93q-cq9w-58p7","url":"https://osv.dev/vulnerability/GHSA-w93q-cq9w-58p7"},{"source":"nvd","source_id":"CVE-2026-54606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54606"}],"summary":"SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed"}