Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A <script element placed directly inside an <svg (or MathML) container was not removed by Jodit's clean-html sanitizer. The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names — an SVG script reports "script", not "SCRIPT" — so the default denyTags list (which includes script) did not match it. The script therefore survived in the editor value and serialized output, where it could execute when the content was loaded back into a page or editor. Proof of concept Load the payload into the editor (e.g. via source mode) and the <script is preserved in editor.value and executes. Impact Stored / DOM cross-site scripting. An application that persists editor output and later renders or re-opens it in Jodit can have attacker-supplied script run in a victim's (e.g. an administrator's) authenticated browser context. Patch Fixed in 4.13.6: the deny/allow lookup now normalises the tag name to upper…
Recommended action: Upgrade to 4.13.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
jodit's built-in clean-html sanitizer can be bypassed by a MathML/<style carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value. When an application supplies attacker-influenced HTML to the editor's value-set or insertion paths, the sanitized output still contains a live <img ... onload=... (or another non-onerror handler such as onfocus). A consumer that renders that output (element.innerHTML = editor.value) executes the handler with no user interaction. This is a stored cross-site scripting vulnerability, confirmed live on the shipped es2021/jodit.min.js for 4.12.25 and the latest 4.12.27 (in Chromium via a client-side innerHTML consumer, and in Firefox via server-rendered / document-context output; see the cross-browser note under Proof of concept). Details The bypass exploits the order in which clean-html parses, walks, and re-serializes the value. 1. On the value-set path, the clean-html…
Recommended action: Upgrade to 4.12.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype (prototype pollution). Affected - Package: jodit (npm) - Versions: < 4.12.18 - Public API: Jodit.configure(options) Proof of Concept Impact Applications that pass user-controlled or partially user-controlled configuration into Jodit.configure() could be vulnerable to prototype pollution: unexpected property injection, logic bypass, denial of service, or secondary security issues. Patch Fixed in 4.12.18 by rejecting proto, constructor, and prototype at every merge level in ConfigMerge and ConfigProto. Credit Responsibly reported by Junming Wu.
Recommended action: Upgrade to 4.12.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
jodit's sanitizeHTMLElement neutralizes a javascript: href using a bare href.trim().indexOf('javascript') === 0 check. This omits the normalization jodit applies to every other URL attribute: isDangerousUrl strips control bytes with value.replace(/[\u0000-\u0020]+/g, '') and lowercases the value before testing the scheme. Because the href check does neither, it is bypassed by three obfuscation classes, all confirmed firing on click against the shipped 4.12.30 build: 1. Case variants: JAVASCRIPT:, Javascript:, jaVaScRiPt: (the check is case-sensitive). 2. A leading C0 control byte, e.g. a \x01 prefix before lowercase javascript: (trim() does not remove bytes in the \x00-\x08 / \x0e-\x1f range, but the browser strips a leading control byte before resolving the scheme). 3. An embedded tab or newline inside the scheme, e.g. java\tscript: or java\nscript: (the browser strips tab/newline from a URL, but indexOf('javascript') sees the broken word and does not match). The dangerous…
Recommended action: Upgrade to 4.12.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jodit.modules.Helpers.set(chain, value, obj) walks the dot-separated chain, creating and following each path segment, without filtering prototype-mutating keys. A chain that begins with (or contains) proto, constructor, or prototype lets the final assignment reach and mutate Object.prototype (prototype pollution). Affected - Package: jodit (npm) - Versions: < 4.12.26 - Public API: Jodit.modules.Helpers.set(chain, value, obj) Proof of Concept Impact Applications that pass a user-controlled or partially user-controlled key path into Jodit.modules.Helpers.set() could be vulnerable to prototype pollution (CWE-1321): unexpected property injection, logic bypass, denial of service, or secondary security issues. Patch Fixed in 4.12.26 by rejecting any chain whose segments include proto, constructor, or prototype, reusing the same guard introduced for Jodit.configure() in 4.12.18. Credit Responsibly reported by Junming Wu.
Recommended action: Upgrade to 4.12.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.