Read the docs
TI-2026-39562 Aliases CVE-2026-54756GHSA-5957-5c94-3v7w

Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge

Priority MEDIUM 63CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.18, Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys, potentially causing a Prototype Pollution vulnerability. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype. Applications that pass user-controlled or partially user-controlled configuration into Jodit.configure() may be vulnerable. This issue was fixed in version 4.12.18.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00462 40th percentileScored 2026-11-07
Fix Fixed jodit (xdan): 4.12.18jodit (npm): 4.12.18

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
xdanjoditbefore 4.12.184.12.18Patch availableCNA
—jodit (npm)before 4.12.184.12.18Patch availableGHSA-5957-5c94-3v7w
  • jodit Vendorxdan Affected before 4.12.18 Fixed in 4.12.18 Patch available CNA
  • jodit (npm) Vendor— Affected before 4.12.18 Fixed in 4.12.18 Patch available GHSA-5957-5c94-3v7w

Remediation

  • Fix · CNA jodit (xdan) Fixed in 4.12.18
  • Fix · GHSA-5957-5c94-3v7w jodit (npm) Fixed in 4.12.18 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54756
  2. 2026-10-03 Alias added: GHSA-5957-5c94-3v7w

References

Advisory 1

Other 4

  • TI-2026-41956 Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier CVSS 3.1HIGH 7.2
  • TI-2026-40339 Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set() CVSS 4.0MEDIUM 6.3
  • TI-2026-44496 Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS CVSS 3.1MEDIUM 5.4
  • TI-2026-46914 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences