TI-2026-41956 Aliases CVE-2026-58263 GHSA-rxcw-mc6f-6hr3

Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

HIGH 71CWE-79Published 2026-07-01 · Updated 2026-07-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value, potentially causing Mutation XSS. When an application supplies attacker-influenced HTML to the editor's value-set or insertion paths, the sanitized output still contains a live <img ... onload=...> (or another non-onerror handler such as onfocus). A consumer that renders that output (element.innerHTML = editor.value) executes the handler with no user interaction. This issue has been fixed in version 4.12.28.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00216 12th percentileScored 2026-11-07

Fix Fixed jodit (xdan): 4.12.28jodit (npm): 4.12.28

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
xdan	jodit	before 4.12.28	4.12.28	Patch available	CNA
—	jodit (npm)	before 4.12.28	4.12.28	Patch available	GHSA-rxcw-mc6f-6hr3

jodit Vendorxdan Affected before 4.12.28 Fixed in 4.12.28 Patch available CNA
jodit (npm) Vendor— Affected before 4.12.28 Fixed in 4.12.28 Patch available GHSA-rxcw-mc6f-6hr3

Remediation

Fix · CNA jodit (xdan) Fixed in 4.12.28
Fix · GHSA-rxcw-mc6f-6hr3 jodit (npm) Fixed in 4.12.28 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-58263
2026-10-03 Alias added: GHSA-rxcw-mc6f-6hr3

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-58263

Other 4

TI-2026-40339 Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set() CVSS 4.0MEDIUM 6.3
TI-2026-39562 Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge CVSS 4.0MEDIUM 6.3
TI-2026-44496 Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS CVSS 3.1MEDIUM 5.4
TI-2026-46914 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences