AIKIDO-2026-746486

TL;DR

SunEditor's HTML sanitization does not fully strip executable event-handler attributes from crafted namespaced or custom tags such as <a:b>. An attacker can submit editor content containing these tags with attributes like onclick or JavaScript URI schemes, and the malicious attributes survive sanitization and execute when the rendered element is interacted with. Depending on how the editor output is stored and displayed, this enables stored or reflected cross-site scripting in the victim's browser context. The fix sanitizes code-view input before parsing and tightens the disallowed-tag matching to cover additional script-adjacent tags and namespaced selectors.