A critical stored cross-site scripting vulnerability in SunEditor allows unauthenticated attackers to execute arbitrary code within the browser context of unsuspecting users.

The vulnerability exists in the sanitizer function within src/lib/core.js, which fails to properly filter namespaced or custom HTML elements. This allows an unauthenticated attacker to inject malicious event-handler attributes that execute when the content is rendered and interacted with by a user.

Successful exploitation of this vulnerability enables attackers to perform unauthorized actions within the browser context of affected users, potentially leading to session hijacking, data theft, or unauthorized modification of application content. Given the CVSS score of 10.0, this flaw represents a critical risk to organizational data integrity and user security, necessitating immediate remediation to prevent widespread compromise.

Immediate Action: Update the SunEditor dependency to version 2.47.11 or later to implement the corrected sanitization logic.

Proactive Monitoring: Review application logs for anomalous HTML input patterns or unexpected script execution events within the editor component.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources of executable scripts and prevent the execution of unauthorized inline handlers.

Public Exploit Available: No

Due to the critical severity and the potential for full compromise of the user browser session, organizations utilizing SunEditor must prioritize this update immediately. Ensure that all downstream applications incorporating this library are patched to version 2.47.11 to neutralize the risk of stored cross-site scripting.