Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
Priority MEDIUM 57CWE-80Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-80.
Summary
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00529 45th percentileScored 2026-11-07
Fix Fixed jodit (xdan): 4.13.6jodit (npm): 4.13.6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| xdan | jodit | before 4.13.6 | 4.13.6 | Patch available | CNA |
| — | jodit (npm) | before 4.13.6 | 4.13.6 | Patch available | GHSA-45qg-252v-3f7p |
- jodit Vendorxdan Affected before 4.13.6 Fixed in 4.13.6 Patch available CNA
- jodit (npm) Vendor— Affected before 4.13.6 Fixed in 4.13.6 Patch available GHSA-45qg-252v-3f7p
Remediation
- Fix · CNA jodit (xdan) Fixed in 4.13.6
- Fix · GHSA-45qg-252v-3f7p jodit (npm) Fixed in 4.13.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-65841
- 2026-10-03 Alias added: GHSA-45qg-252v-3f7p
References
More xdan vulnerabilities
- TI-2026-41956 Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier CVSS 3.1HIGH 7.2
- TI-2026-40339 Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set() CVSS 4.0MEDIUM 6.3
- TI-2026-39562 Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge CVSS 4.0MEDIUM 6.3
- TI-2026-44496 Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-65841 · CVE Program
- CVE-2026-65841 · NVD
- FIRST EPSS
- GHSA-45qg-252v-3f7p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences