5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25581

CVE-2026-25581: SCEditor affected by DOM XSS via emoticon URL/HTML injection

SCEditor is a lightweight WYSIWYG BBCode and XHTML editor. Prior to 3.2.1, if an attacker has the ability control configuration options passed to sceditor.create(), like emoticons, charset, etc. then it's possible for them to trigger an XSS attack due to lack of sanitisation of configuration options. This vulnerability is fixed in 3.2.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25581

CVE-2026-25581:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sceditor	npm	<= 3.2.0	3.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a DOM-based Cross-Site Scripting (XSS) issue within the SCEditor library, identified as GHSA-25fq-6qgg-qpj8. The root cause is the lack of input sanitization for configuration options passed to the editor's constructor (sceditor.create()). An attacker with control over these options could inject malicious code.

The analysis of the patch commit 5733aed4f0e257cb78e1ba191715fc458cbd473d reveals several key points of failure:

Unsanitized Emoticon URLs: The proof of concept demonstrates that the emoticons configuration option can be exploited. The code in src/lib/SCEditor.js (the SCEditor constructor) and src/lib/defaultCommands.js (the defaultCmds.emoticon._dropDown function) directly used URLs from this configuration to construct <img> tags' src attributes. The patch applies escape.uriScheme to these URLs to prevent malicious schemes like javascript:, or embedded HTML through quote escaping.
Insecure Template Rendering: The core template function in src/lib/templates.js performed simple string replacement without escaping or sanitizing the values. This meant any configuration option rendered via this template function was a potential XSS vector. The patch rectifies this by integrating DOMPurify for robust HTML sanitization and adding entity escaping for template parameters by default.
Other Unsanitized Options: The patch also adds sanitization for other options like style and charset in the main SCEditor constructor, indicating a broader pattern of insufficient input validation for configuration settings.

In summary, the vulnerability was triggered during the editor's initialization and UI component rendering (like the emoticon dropdown), where configuration options were insecurely embedded into the DOM. The identified vulnerable functions are the primary locations where this insecure handling occurred.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.