xdan jodit vulnerabilities

Newest CVEs

• CVE-2026-65841

  Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

  xdan · jodit

  Medium5.3
• CVE-2026-62324

  Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

  xdan · jodit

  Medium5.4
• CVE-2026-58263

  Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

  xdan · jodit

  High7.2
• CVE-2026-54756

  Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge

  xdan · jodit

  Medium6.3
• CVE-2026-55886

  Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()

  xdan · jodit

  Medium6.3