Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

SunEditor: Critical XSS vulnerability - sanitizer bypass

Fix availableCritical · CVSS 10EPSS 0.39%

Published Sep 24, 2026 · updated Sep 24, 2026

What to do

  1. Upgrade to a fixed version: suneditor 2.47.11.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmsuneditor41,222 downloads/week

Vulnerable versions
<= 2.47.10
Fixed in
2.47.11

Check your project: npm ls suneditor --all

Is suneditor@2.47.11 safe to install? See the upgrade verdict →

Sources

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

← All critical vulnerabilities