CVE-2026-25581: Sceditor WYSIWYG Editor XSS Vulnerability

CVE-2026-25581 Overview

CVE-2026-25581 is a cross-site scripting (XSS) vulnerability [CWE-79] in SCEditor, a lightweight WYSIWYG BBCode and XHTML editor used in web applications. Versions prior to 3.2.1 fail to sanitize configuration options passed to the sceditor.create() initializer. An attacker who can influence configuration values such as emoticons, charset, or style can inject script content that executes in the victim's browser context. The issue is fixed in version 3.2.1.

Critical Impact
Attackers able to control SCEditor configuration parameters can execute arbitrary JavaScript in a victim's browser, leading to session theft, account takeover, or content manipulation on integrating applications.

Affected Products

SCEditor versions prior to 3.2.1
Web applications embedding SCEditor with user-influenced configuration options
BBCode and XHTML editor integrations using sceditor.create()

Discovery Timeline

2026-02-06 - CVE-2026-25581 published to the National Vulnerability Database (NVD)
2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-25581

Vulnerability Analysis

The flaw resides in SCEditor's initialization routine within src/lib/SCEditor.js. The editor builds an iframe document by writing an HTML template populated with attacker-influenceable configuration values. Before the patch, fields such as options.style and options.charset were inserted into the generated HTML without escaping or validation, enabling injection of attribute-breaking characters and inline event handlers.

A related sink in src/lib/defaultCommands.js constructed inline style="background-color: ..." markup for the color picker using raw entries from the colors configuration option, allowing CSS context escapes that lead to script execution.

Exploitation requires that the attacker influence configuration arguments supplied to sceditor.create(). In typical deployments this can occur where applications derive editor settings from user profiles, theme parameters, URL parameters, or stored multi-tenant configuration.

Root Cause

SCEditor concatenated configuration strings directly into HTML templates without entity encoding or allow-list validation. The style, charset, and color picker fields lacked input filtering, breaching the trust boundary between configuration data and rendered DOM.

Attack Vector

The vulnerability is network-exploitable, requires low privileges, and requires user interaction such as loading an editor page with attacker-supplied configuration. A successful injection runs script within the editor's document context, where it can read or manipulate the host page through the editor's API surface.

javascript

// Patch excerpt: src/lib/SCEditor.js
// Validates style and charset before writing them into the iframe template
if (!domPurify.isValidAttribute('link', 'href', options.style)) {
    options.style = '';
}

if (!/^[a-z\-0-9 ]+$/i.test(options.charset)) {
    options.charset = 'UTF-8';
}

wysiwygDocument = wysiwygEditor.contentDocument;
wysiwygDocument.open();
wysiwygDocument.write(_tmpl('html', {
    attrs: browser.ios ? ' class="ios"' : '',
    spellcheck: options.spellcheck ? '' : 'spellcheck="false"',
    charset: options.charset,
    style: escape.entities(options.style)
}, false, false));

Source: GitHub Commit 5733aed

javascript

// Patch excerpt: src/lib/defaultCommands.js
// Restricts color picker values to a safe character set
column.split(',').forEach(function (color) {
    // Only allow named, #aaa, hsl(1.1 50% / 1), etc.
    if (!/^[\#a-z0-9\-\(\) \/%\.]+$/i.test(color)) {
        color = '';
    }

    html +=
        '<a href="#" class="sceditor-color-option"' +
        ' style="background-color: ' + color + '"' +

Source: GitHub Commit 5733aed

Detection Methods for CVE-2026-25581

Indicators of Compromise

Unexpected <script> tags or inline event handlers rendered inside SCEditor iframes
HTTP requests delivering editor configuration containing characters such as ", <, >, or onerror= in style, charset, or color values
Outbound browser requests to attacker-controlled hosts originating from pages embedding SCEditor

Detection Strategies

Inventory web applications and identify SCEditor versions in use by scanning bundled JavaScript for the sceditor namespace and version constants
Inspect server-side code paths that populate sceditor.create() options for user-controlled inputs without sanitization
Review browser Content Security Policy (CSP) violation reports for inline script execution within editor iframes

Monitoring Recommendations

Enable CSP report-only or enforcing policies that block inline scripts and report violations to a central collector
Log and alert on web application requests that pass raw values to editor configuration endpoints
Monitor third-party JavaScript dependency manifests for SCEditor versions below 3.2.1

How to Mitigate CVE-2026-25581

Immediate Actions Required

Upgrade SCEditor to version 3.2.1 or later across all applications
Audit application code for points where user-controlled data flows into sceditor.create() configuration arguments
Apply server-side allow-list validation for any configuration values exposed to end users

Patch Information

The vulnerability is fixed in SCEditor 3.2.1. The fix adds entity escaping for options.style, regex validation for options.charset, and an allow-list for color picker values. Review the GitHub Security Advisory GHSA-25fq-6qgg-qpj8 and the upstream commit for technical details.

Workarounds

Hardcode SCEditor configuration values server-side and reject any client-supplied overrides
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources
Sanitize or reject configuration inputs containing characters outside an explicit allow-list before passing them to the editor

bash

# Update SCEditor via npm to the patched release
npm install sceditor@^3.2.1

# Verify the installed version
npm ls sceditor