Read the docs
TI-2026-44496 Aliases CVE-2026-62324GHSA-j839-gqq4-gf9j

Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Priority MEDIUM 58CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed jodit (xdan): 4.12.31jodit (npm): 4.12.31

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
xdanjoditbefore 4.12.314.12.31Patch availableCNA
—jodit (npm)before 4.12.314.12.31Patch availableGHSA-j839-gqq4-gf9j
  • jodit Vendorxdan Affected before 4.12.31 Fixed in 4.12.31 Patch available CNA
  • jodit (npm) Vendor— Affected before 4.12.31 Fixed in 4.12.31 Patch available GHSA-j839-gqq4-gf9j

Remediation

  • Fix · CNA jodit (xdan) Fixed in 4.12.31
  • Fix · GHSA-j839-gqq4-gf9j jodit (npm) Fixed in 4.12.31 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-62324
  2. 2026-10-03 Alias added: GHSA-j839-gqq4-gf9j

References

Other 4

  • TI-2026-41956 Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier CVSS 3.1HIGH 7.2
  • TI-2026-40339 Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set() CVSS 4.0MEDIUM 6.3
  • TI-2026-39562 Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge CVSS 4.0MEDIUM 6.3
  • TI-2026-46914 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences