medium5.4
CVE-2026-25581
SCEditor has DOM XSS via emoticon URL/HTML injection
Impact
If an attacker has the ability control configuration options passed to `sceditor.create()`, like `emoticons`, `charset`, etc. then it's possible for them to trigger an XSS attack due to lack of sanitisation of configuration options. Proof of concept: ```js sceditor.create(textarea, { emoticons: { dropdown: { ':)': { url: 'x" onerror="window.__xss = true' } } } }); ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | sceditor | <= 3.2.0 | 3.2.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sceditor | Sceditor | before 3.2.1 |