Executive brief
Jodit, a popular web-based text editor, contains a vulnerability that allows an attacker to inject malicious properties into the application's core JavaScript objects. If an application allows users to influence the editor's configuration settings, an attacker could potentially bypass security logic, cause the application to crash, or gain unauthorized access to data. This issue affects how the editor merges configuration options and can be resolved by updating to the latest version.
Technical details
A prototype pollution vulnerability exists in Jodit versions prior to 4.12.18. The issue resides within the `Jodit.configure()` method and internal helpers `ConfigMerge` and `ConfigProto`, which recursively merge user-supplied configuration options without sanitizing sensitive keys. An attacker can provide a specially crafted JSON payload containing `__proto__`, `constructor`, or `prototype` keys. When processed, these keys allow the attacker to mutate `Object.prototype`, leading to property injection that can result in logic bypasses or denial of service. The vulnerability is fixed in version 4.12.18 by implementing a blocklist for these specific keys during the merge process.
Affected products
- xdan jodit < 4.12.18
Timeline
- 2026-06-09: patched: Fixed in version 4.12.18
- 2026-07-01: advisory: NVD published date
- 2026-07-31: disclosed: GitHub Advisory published