NPM: Jodit has prototype pollution via Jodit.configure() / ConfigMerge

NPM: Jodit has prototype pollution via Jodit.configure / ConfigMerge vulnerability discovered by ? in WordPress Npm jodit versions 4.12.18...

Jodit has prototype pollution via Jodit.configure() / ConfigMerge

Summary Jodit.configureoptions — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototy...

CVE-2026-54756 Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge

Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.18, Jodit.configureoptions — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering...