Quick answers
- Is CVE-2026-58263 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-58263 being exploited in the wild.
- How severe is CVE-2026-58263?
- High severity, with a CVSS score of 7.2, published 1 July 2026.
- Which products and versions are affected?
- jodit (npm) < 4.12.28, SEMVER:introduced=0,fixed=4.12.28.
- Is there a fix for CVE-2026-58263?
- Yes. jodit (npm): upgrade to 4.12.28 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-58263 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-58263?
- Check whether you run jodit (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- jodit (npm): upgrade to 4.12.28 or later
npm install jodit@4.12.28
Technical details
A mutation cross-site scripting (mXSS) vulnerability exists in Jodit Editor's 'clean-html' plugin. The sanitizer's element walk can be bypassed by nesting a dangerous element (like an <img> with an onload handler) inside a MathML structure (e.g., math > mtext > table > mglyph > style). During the initial sanitization pass, the browser's parser treats the payload as raw text, causing the sanitizer to skip it. When the editor subsequently re-parses this content into the live DOM, the payload is 'hoisted' out of the style tag and becomes an active, executable element. While the editor has an asynchronous on-change cleaner, it only targets 'onerror' attributes, allowing other event handlers like 'onload' or 'onfocus' to persist. This affects versions prior to 4.12.28.
Affected products
- xdan jodit < 4.12.28
Identifiers
- CVE-2026-58263
- GHSA-rxcw-mc6f-6hr3
Timeline
- advisory: GitHub Advisory GHSA-rxcw-mc6f-6hr3 published
- 2026-07-31: patched: Fixed in version 4.12.28