CVE-2026-65841
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Jodit Editor prior to version 4.13.6, the clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element to remain in editor.value and execute when content is loaded.
Risk Assessment
An attacker can inject a malicious script that executes in the victim's browser, leading to data theft or session hijacking.
Recommendation
Update Jodit Editor to version 4.13.6 or later.
Other vulnerabilities in Jodit Editor
See all- CVE-2026-62324Medium
In Jodit Editor prior to version 4.12.31, the sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering. A victim clicking a stored link can execute attacker-controlled script.
- CVE-2026-58263High
Jodit Editor versions before 4.12.28 contain an XSS vulnerability due to bypass of the clean-html sanitizer. An attacker can use MathML or <style> as a carrier to hide a dangerous element from the sanitizer, allowing onload or onfocus events to be placed in the editor. When the application renders the editor content, JavaScript code executes without user interaction.
- CVE-2026-55886Medium
Jodit Editor versions prior to 4.12.26 are vulnerable to Prototype Pollution via the Jodit.modules.Helpers.set() function. An attacker can pass a crafted key chain containing __proto__, constructor, or prototype, leading to Object.prototype modification and injection of unexpected properties.
- CVE-2026-54756Medium
In Jodit Editor prior to version 4.12.18, the Jodit.configure() function and internal ConfigMerge/ConfigProto helpers merged user-supplied options without filtering prototype-mutating keys, leading to a Prototype Pollution vulnerability.
- CVE-2023-42399Medium
A Cross-Site Scripting (XSS) vulnerability was found in Jodit Editor version 4.0.0-beta.86. The flaw allows a remote attacker to inject malicious JavaScript code through the rich text editor component.
Original NVD description (English source)
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.