CVE-2026-25581

描述

If an attacker has the ability control configuration options passed to `sceditor.create()`, like `emoticons`, `charset`, etc. then it's possible for them to trigger an XSS attack due to lack of sanitisation of configuration options. Proof of concept: ```js sceditor.create(textarea, { emoticons: { dropdown: { ':)': { url: 'x" onerror="window.__xss = true' } } } }); ```

如何修補 CVE-2026-25581

要修補 CVE-2026-25581,請將受影響套件升級到下列已修補版本。

• —升級至 3.2.1 或更新版本

CVE-2026-25581 正在被利用嗎?

低 — EPSS 為 0.0%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 3.2.1

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-25581
• PATCHgithub.com/samclarke/SCEditor
• WEBgithub.com/samclarke/SCEditor/commit/5733aed4f0e257cb78e1ba191715fc458cbd473d
• WEBgithub.com/samclarke/SCEditor/security/advisories/GHSA-25fq-6qgg-qpj8