Executive brief
Jodit is a popular rich-text editor (WYSIWYG) embedded in web applications to allow users to compose and format content. The editor fails to properly sanitize maliciously crafted HTML when users paste content, allowing attackers to inject and execute arbitrary JavaScript code. An attacker can exploit this by tricking users into pasting crafted content from a malicious source, potentially stealing session credentials, injecting malware, or defacing the application.
Technical details
Jodit Editor contains a cross-site scripting (CWE-79) vulnerability in its paste handling logic. The vulnerability arises from incomplete sanitization of HTML input when users paste content, allowing specially crafted payloads to bypass custom sanitization functions. The attack vector is user interaction—users must paste attacker-controlled content into the editor; no network-level attack or privilege escalation is required. A proof-of-concept demonstrates that pasting HTML containing attributes like `onerror="alert(123)"` on an `<img>` tag results in arbitrary JavaScript execution. The issue was reported in May 2022 but remains unpatched as of the advisory publication; the maintainer's custom sanitization functions have proven insufficient against bypass techniques. Users should update to patched versions beyond 3.24.2 when available.
Affected products
- xdan jodit all versions up to and including 3.24.2
Timeline
- 2022-05-12: disclosed: vulnerability reported to maintainer
- 2022-09-25: advisory: GHSA-42hx-vrxx-5r6v and CVE-2022-23461 published
- 2022-09-24: other: CVE-2022-23461 assigned (NVD published)