Executive brief
Jodit Editor is a popular tool used by websites to provide rich text and image editing capabilities to users. A security flaw in how the editor handles data paths allows an attacker to inject malicious properties into the application's core objects. This could lead to application crashes, bypass of security logic, or unauthorized changes to how the website functions.
Technical details
A prototype pollution vulnerability exists in Jodit Editor versions prior to 4.12.26. The root cause is located in the Jodit.modules.Helpers.set(chain, value, obj) function, which processes dot-separated strings to navigate object paths without filtering for sensitive keys such as __proto__, constructor, or prototype. If an application passes user-controlled input into this function, an attacker can reach and mutate the global Object.prototype. This can result in unexpected property injection, logic bypasses, or denial of service. The issue is resolved in version 4.12.26 by implementing a guard that rejects chains containing prototype-mutating segments.
Affected products
- xdan Jodit Editor < 4.12.26
Timeline
- 2026-06-16: advisory: GitHub advisory published by vendor
- 2026-07-01: disclosed: NVD publication date
- 2026-07-01: patched: Fix confirmed in version 4.12.26