CVE-2026-58263
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Jodit Editor versions before 4.12.28 contain an XSS vulnerability due to bypass of the clean-html sanitizer. An attacker can use MathML or <style> as a carrier to hide a dangerous element from the sanitizer, allowing onload or onfocus events to be placed in the editor. When the application renders the editor content, JavaScript code executes without user interaction.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser context, potentially leading to session theft, page modification, or data leakage. The vulnerability can be exploited without user interaction.
Recommendation
Update Jodit Editor to version 4.12.28 or later. If an update is not possible, avoid rendering user-supplied HTML content without additional sanitization.
Other vulnerabilities in Jodit Editor
See all- CVE-2026-65841Medium
In Jodit Editor prior to version 4.13.6, the clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element to remain in editor.value and execute when content is loaded.
- CVE-2026-62324Medium
In Jodit Editor prior to version 4.12.31, the sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering. A victim clicking a stored link can execute attacker-controlled script.
- CVE-2026-55886Medium
Jodit Editor versions prior to 4.12.26 are vulnerable to Prototype Pollution via the Jodit.modules.Helpers.set() function. An attacker can pass a crafted key chain containing __proto__, constructor, or prototype, leading to Object.prototype modification and injection of unexpected properties.
- CVE-2026-54756Medium
In Jodit Editor prior to version 4.12.18, the Jodit.configure() function and internal ConfigMerge/ConfigProto helpers merged user-supplied options without filtering prototype-mutating keys, leading to a Prototype Pollution vulnerability.
- CVE-2023-42399Medium
A Cross-Site Scripting (XSS) vulnerability was found in Jodit Editor version 4.0.0-beta.86. The flaw allows a remote attacker to inject malicious JavaScript code through the rich text editor component.
Original NVD description (English source)
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value, potentially causing Mutation XSS. When an application supplies attacker-influenced HTML to the editor's value-set or insertion paths, the sanitized output still contains a live <img ... onload=...> (or another non-onerror handler such as onfocus). A consumer that renders that output (element.innerHTML = editor.value) executes the handler with no user interaction. This issue has been fixed in version 4.12.28.