Executive brief
Jodit Editor, a popular WYSIWYG editor used in web applications, contains a vulnerability that allows attackers to bypass its security filters. By submitting specially crafted content, an attacker can execute malicious scripts in the browsers of other users who view that content. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive information without any user interaction.
Technical details
A mutation cross-site scripting (mXSS) vulnerability exists in Jodit Editor's 'clean-html' plugin. The sanitizer's element walk can be bypassed by nesting a dangerous element (like an <img> with an onload handler) inside a MathML structure (e.g., math > mtext > table > mglyph > style). During the initial sanitization pass, the browser's parser treats the payload as raw text, causing the sanitizer to skip it. When the editor subsequently re-parses this content into the live DOM, the payload is 'hoisted' out of the style tag and becomes an active, executable element. While the editor has an asynchronous on-change cleaner, it only targets 'onerror' attributes, allowing other event handlers like 'onload' or 'onfocus' to persist. This affects versions prior to 4.12.28.
Affected products
- xdan jodit < 4.12.28
Timeline
- advisory: GitHub Advisory GHSA-rxcw-mc6f-6hr3 published
- 2026-07-31: patched: Fixed in version 4.12.28