Read the docs
TI-2026-40339 Aliases CVE-2026-55886GHSA-vpmm-x3fm-qr5c

Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()

Priority HIGH 67CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. Versions prior to 4.12.26 are vulnerable to Prototype Pollution through Jodit.modules.Helpers.set(chain, value, obj), which walks the dot-separated chain, creating and following each path segment without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype. Applications that pass a user-controlled or partially user-controlled key path into Jodit.modules.Helpers.set() could be vulnerable, causing unexpected property injection, logic bypass, denial of service, or secondary security issues. This issue has been fixed in version 4.12.26.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00534 45th percentileScored 2026-11-07
Fix Fixed jodit (xdan): 4.12.26jodit (npm): 4.12.26

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
xdanjoditbefore 4.12.264.12.26Patch availableCNA
—jodit (npm)before 4.12.264.12.26Patch availableGHSA-vpmm-x3fm-qr5c
  • jodit Vendorxdan Affected before 4.12.26 Fixed in 4.12.26 Patch available CNA
  • jodit (npm) Vendor— Affected before 4.12.26 Fixed in 4.12.26 Patch available GHSA-vpmm-x3fm-qr5c

Remediation

  • Fix · CNA jodit (xdan) Fixed in 4.12.26
  • Fix · GHSA-vpmm-x3fm-qr5c jodit (npm) Fixed in 4.12.26 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55886
  2. 2026-10-03 Alias added: GHSA-vpmm-x3fm-qr5c

References

Advisory 1

Other 2

  • TI-2026-41956 Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier CVSS 3.1HIGH 7.2
  • TI-2026-39562 Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge CVSS 4.0MEDIUM 6.3
  • TI-2026-44496 Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS CVSS 3.1MEDIUM 5.4
  • TI-2026-46914 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences