SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.

Affected: npm: suneditor

## Summary

SUNEDITOR `v2.47.10` appears to allow JavaScript execution through crafted namespaced HTML elements.

The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that executes JavaScript when the rendered element is interacted with.

This behavior was observed after the changes introduced in this commit:

https://github.com/JiHong88/suneditor/commit/9ed405fb0de676e56cd0e6a13c19c103ad5948d3

---

## Affected Version

Confirmed vulnerable:

* SUNEDITOR =< `2.47.10`

Potentially affected:

* Previous versions, if the same sanitization logic is still present

---

## Proof of Concept

The following payload preserves an executable event handler:

```html <a:b src="/x"><iframe src=javascript:alert(1)></iframe></a:b>

<p><a:b src="/x" onclick="document.body.style.background='red'">click</a:b></p> ```

Simplified PoC:

```html <a:b src="/x" onclick="console.log('XSS:',document.domain,document.cookie)">click</a:b> ```

```html <p><a:b src="/x" onmouseover="alert('XSS — '+document.domain)">📎 Click here for solutions</a:b></p> ``` ---

## Steps to Reproduce

1. Open SUNEDITOR using version `2.47.10`. 2. Insert the payload above into the editor. 3. Save or render the generated content. 4. Click the generated element. 5. Observe that JavaScript is executed.

---

## Impact

This may allow an attacker to inject arbitrary JavaScript into rendered editor content.…