CVE-2026-54756: xdan Jodit Editor prototype pollution in Jodit.configure

CVE-2026-54756 · Severity: medium · CVSS 4 · Published 2026-07-01

Jodit is a popular rich-text editor (WYSIWYG) used in web applications to provide content editing capabilities. A prototype pollution vulnerability in the Jodit.configure() function allows an attacker who can control configuration input to inject malicious properties into JavaScript's Object.prototype, potentially leading to unexpected behavior, logic bypass, denial of service, or secondary exploits in dependent code.

Technologies: jodit (npm), Xdan Jodit Editor. Vendors: npm, Xdan.

Quick answers

Is CVE-2026-54756 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54756 being exploited in the wild.
How severe is CVE-2026-54756?
Medium severity, with a CVSS score of 4, published 1 July 2026.
Which products and versions are affected?
jodit (npm) < 4.12.18, SEMVER:introduced=0,fixed=4.12.18; Xdan Jodit Editor < 4.12.18.
Is there a fix for CVE-2026-54756?
Yes. jodit (npm): upgrade to 4.12.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54756 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54756?
Check whether you run jodit (npm) or Xdan Jodit Editor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • jodit (npm): upgrade to 4.12.18 or later
    npm install jodit@4.12.18

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in Jodit's configuration merging logic. The root cause is that ConfigMerge and ConfigProto helpers recursively merge user-controlled configuration objects into the editor's default configuration without sanitizing keys like __proto__, constructor, or prototype. An attacker who can inject or control configuration passed to Jodit.configure() can craft a JSON payload with nested __proto__ keys to pollute Object.prototype (e.g., {"controls":{"__proto__":{"polluted":"yes"}}}) affecting all objects in the application. No special privileges or authentication are required; the attack is triggered when an application passes untrusted configuration into Jodit.configure(). The impact ranges from unexpected property injection and logic bypass to denial of service or secondary security issues. The patch, released in version 4.12.18, filters out __proto__, constructor, and prototype keys at every nesting level during the merge operation.

Affected products

  • xdan jodit < 4.12.18

Identifiers

  • CVE-2026-54756
  • GHSA-5957-5c94-3v7w

Timeline

  • 2026-06-09: disclosed: Vulnerability responsibly reported by Junming Wu
  • 2026-07-31: patched: Fixed in version 4.12.18 by rejecting __proto__, constructor, and prototype keys at every merge level

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.