CVE-2026-65841

CVE-2026-65841 affects Jodit Editor prior to version 4.13.6, where the clean-html denyTags filter fails to normalize foreign SVG/MathML script node names, allowing a [removed] element nested inside SVG (or MathML) to survive and execute when content is loaded. The issue stems from insufficient no...