Read the docs
TI-2022-07521 Aliases CVE-2022-23461GHSA-42hx-vrxx-5r6v

Cross-Site Scripting (XSS) in Jodit Editor

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00619 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
xdanJodit Editor3.20.4 – 3.20.4—No fix listedCNA
—jodit (npm)up to 3.24.2—No fix listedGHSA-42hx-vrxx-5r6v
  • Jodit Editor Vendorxdan Affected 3.20.4 – 3.20.4 Fixed in — No fix listed CNA
  • jodit (npm) Vendor— Affected up to 3.24.2 Fixed in — No fix listed GHSA-42hx-vrxx-5r6v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xdsoft:jodit_editor:*:*:*:*:*:*:*:*3.0.0 – 3.20.4VulnerableXdsoft
  • cpe:2.3:a:xdsoft:jodit_editor:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.20.4 Vulnerable ·Xdsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23461
  2. 2026-10-03 Alias added: GHSA-42hx-vrxx-5r6v

References

Exploit 1

Advisory 2

Other 1

  • TI-2026-41956 Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier CVSS 3.1HIGH 7.2
  • TI-2026-40339 Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set() CVSS 4.0MEDIUM 6.3
  • TI-2026-39562 Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge CVSS 4.0MEDIUM 6.3
  • TI-2026-44496 Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS CVSS 3.1MEDIUM 5.4
  • TI-2026-46914 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences