CVE-2026-59167

GitHubCritical, npm

SunEditor: Critical XSS vulnerability - sanitizer bypass

SUNEDITOR v2.47.10 appears to allow JavaScript execution through crafted namespaced HTML elements.

No known exploitation
Severity: Critical, CVSS 10.0 (v3.1)
EPSS: 0.39% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
Affected packages: suneditor (npm) <= 2.47.10, fixed in 2.47.11 · GHSA-6rf4-v2fh-m6p4