CVE-2026-62324
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In Jodit Editor prior to version 4.12.31, the sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering. A victim clicking a stored link can execute attacker-controlled script.
Risk Assessment
An attacker can inject a malicious link that, when clicked by a victim, executes a script, leading to data theft or session hijacking.
Recommendation
Update Jodit Editor to version 4.12.31 or later.
Other vulnerabilities in Jodit Editor
See all- CVE-2026-65841Medium
In Jodit Editor prior to version 4.13.6, the clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element to remain in editor.value and execute when content is loaded.
- CVE-2026-58263High
Jodit Editor versions before 4.12.28 contain an XSS vulnerability due to bypass of the clean-html sanitizer. An attacker can use MathML or <style> as a carrier to hide a dangerous element from the sanitizer, allowing onload or onfocus events to be placed in the editor. When the application renders the editor content, JavaScript code executes without user interaction.
- CVE-2026-55886Medium
Jodit Editor versions prior to 4.12.26 are vulnerable to Prototype Pollution via the Jodit.modules.Helpers.set() function. An attacker can pass a crafted key chain containing __proto__, constructor, or prototype, leading to Object.prototype modification and injection of unexpected properties.
- CVE-2026-54756Medium
In Jodit Editor prior to version 4.12.18, the Jodit.configure() function and internal ConfigMerge/ConfigProto helpers merged user-supplied options without filtering prototype-mutating keys, leading to a Prototype Pollution vulnerability.
- CVE-2023-42399Medium
A Cross-Site Scripting (XSS) vulnerability was found in Jodit Editor version 4.0.0-beta.86. The flaw allows a remote attacker to inject malicious JavaScript code through the rich text editor component.
Original NVD description (English source)
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.