SunEditor: Critical XSS vulnerability - sanitizer bypass

## Summary SUNEDITOR `v2.47.10` appears to allow JavaScript execution through crafted namespaced HTML elements. The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that executes JavaScript when the rendered element is interacted with. This behavior was observed after the changes introduced in this commit: https://github.com/JiHong88/suneditor/commit/9ed405fb0de676e56cd0e6a13c19c103ad5948d3 --- ## Affected Version Confirmed vulnerable: * SUNEDITOR =< `2.47.10` Potentially affected: * Previous versions, if the same sanitization logic is still present --- ## Proof of Concept The following payload preserves an executable event handler: ```html click ``` Simplified PoC: ```html click ``` ```html 📎 Click here for solutions ``` --- ## Steps to Reproduce 1. Open SUNEDITOR using version `2.47.10`. 2. Insert the payload above into the editor. 3. Save or render the generated content. 4. Click the generated element. 5. Observe that JavaScript is executed. --- ## Impact This may allow an attacker to inject arbitrary JavaScript into rendered editor content. Depending on how SUNEDITOR is integrated into an application, this could lead to: * Stored XSS * DOM manipulation * Session theft * Credential theft * Account takeover actions performed in the victim’s browser context --- ## Technical Details The issue appears to be related to incomplete handling of namespaced/c