CVE-2026-55886
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Jodit Editor versions prior to 4.12.26 are vulnerable to Prototype Pollution via the Jodit.modules.Helpers.set() function. An attacker can pass a crafted key chain containing __proto__, constructor, or prototype, leading to Object.prototype modification and injection of unexpected properties.
Risk Assessment
The risk includes injection of unexpected properties into objects, logic bypass, denial of service, and potential secondary security issues, especially if the application passes user-controlled data to the vulnerable function.
Recommendation
Immediately update Jodit Editor to version 4.12.26 or later, which includes a fix that eliminates the prototype pollution vulnerability.
Other vulnerabilities in Jodit Editor
See all- CVE-2026-65841Medium
In Jodit Editor prior to version 4.13.6, the clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element to remain in editor.value and execute when content is loaded.
- CVE-2026-62324Medium
In Jodit Editor prior to version 4.12.31, the sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering. A victim clicking a stored link can execute attacker-controlled script.
- CVE-2026-58263High
Jodit Editor versions before 4.12.28 contain an XSS vulnerability due to bypass of the clean-html sanitizer. An attacker can use MathML or <style> as a carrier to hide a dangerous element from the sanitizer, allowing onload or onfocus events to be placed in the editor. When the application renders the editor content, JavaScript code executes without user interaction.
- CVE-2026-54756Medium
In Jodit Editor prior to version 4.12.18, the Jodit.configure() function and internal ConfigMerge/ConfigProto helpers merged user-supplied options without filtering prototype-mutating keys, leading to a Prototype Pollution vulnerability.
- CVE-2023-42399Medium
A Cross-Site Scripting (XSS) vulnerability was found in Jodit Editor version 4.0.0-beta.86. The flaw allows a remote attacker to inject malicious JavaScript code through the rich text editor component.
Original NVD description (English source)
Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. Versions prior to 4.12.26 are vulnerable to Prototype Pollution through Jodit.modules.Helpers.set(chain, value, obj), which walks the dot-separated chain, creating and following each path segment without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype. Applications that pass a user-controlled or partially user-controlled key path into Jodit.modules.Helpers.set() could be vulnerable, causing unexpected property injection, logic bypass, denial of service, or secondary security issues. This issue has been fixed in version 4.12.26.