111 matches found
Cross-Site Scripting (XSS)
Jodit Editor is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the clean-html denyTags filter failing to normalize foreign SVG or MathML script node names, allowing nested script elements to remain in editor.value and execute when the content is loaded...
CVE-2026-62324
creationtimestamp| type| source ---|---|--- 2026-07-31 20:35:20+00:00| published-proof-of-concept| https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j 2026-08-01 00:15:26+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-62324...
CVE-2026-65841
creationtimestamp| type| source ---|---|--- 2026-07-31 20:35:12+00:00| published-proof-of-concept| https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p...
CVE-2026-65841
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...
CVE-2026-62324
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...
CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...
CVE-2026-65841
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...
CVE-2026-65841
CVE-2026-65841 affects Jodit Editor prior to version 4.13.6, where the clean-html denyTags filter fails to normalize foreign SVG/MathML script node names, allowing a [removed] element nested inside SVG (or MathML) to survive and execute when content is loaded. The issue stems from insufficient no...
CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...
CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...
EUVD-2026-51622
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...
Cross-site Scripting (XSS)
Overview org.webjars.npm:jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser Affected versions of this package are vulnerable to Cross-site Scripting XSS via the clean-html. An attacker can execute arbitrary JavaScript code in the context of a user's browser by injecting a...
NPM: Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
NPM: Jodit has cross-site scripting XSS via nested in SVG that bypasses clean-html sanitization vulnerability discovered by ? in WordPress Npm jodit versions 4.13.6...
Cross-site Scripting (XSS)
Overview jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser Affected versions of this package are vulnerable to Cross-site Scripting XSS via the clean-html. An attacker can execute arbitrary JavaScript code in the context of a user's browser by injecting a element within an...
@myrtex-org/ui (>=1.0.1, <=1.2.10), @rosgrant-org/ui (>=1.0.1, <=1.0.4) +3 more potentially affected by CVE-2026-65841 via jodit (>=4.0.18, <=4.3.2)
jodit NPM version =4.0.18, =1.0.1, =1.0.1, =0.41.1, =2.0.0-alpha.2, =17.0.70, =17.2.9 Source cves: CVE-2026-65841 Source advisory: SNYK:JS-JODIT-18507643...
@myrtex-org/ui (>=1.0.1, <=1.2.10), @rosgrant-org/ui (>=1.0.1, <=1.0.4) +3 more potentially affected by CVE-2026-65841 via jodit (>=4.0.18, <=4.3.2)
jodit NPM version =4.0.18, =1.0.1, =1.0.1, =0.41.1, =2.0.0-alpha.2, =17.0.70, =17.2.9 Source cves: CVE-2026-65841 Source advisory: OSV:GHSA-45QG-252V-3F7P...
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
A element placed directly inside an or MathML container was not removed by Jodit's clean-html sanitizer. The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign SVG/MathML elements preserve their original-case node names — an SVG script reports "script", not...
GHSA-45QG-252V-3F7P Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
A element placed directly inside an or MathML container was not removed by Jodit's clean-html sanitizer. The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign SVG/MathML elements preserve their original-case node names — an SVG script reports "script", not...
NPM: Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
NPM: Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier vulnerability discovered by ? in WordPress Npm jodit versions 4.12.28...