Executive brief
Jodit Editor is a popular web-based text editor used in websites to allow users to create and format content. A security flaw in how the editor cleans up web links allows attackers to insert malicious 'javascript:' links that bypass security filters. If a user clicks on one of these links, an attacker could execute unauthorized scripts in the user's browser, potentially leading to account takeover or the theft of sensitive information within that website.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Jodit Editor due to incomplete normalization in the 'sanitizeHTMLElement' method. While other URL attributes are processed via 'isDangerousUrl', the 'href' attribute was checked using a case-sensitive 'indexOf' call on a trimmed string. This allowed bypasses using mixed-case schemes (e.g., 'JAVASCRIPT:'), leading C0 control bytes (e.g., '\x01javascript:'), or embedded tabs and newlines (e.g., 'java\tscript:'), all of which are resolved as valid 'javascript:' URIs by modern browsers. An attacker with permission to save content can inject these obfuscated links, which execute arbitrary JavaScript in the context of the application's origin when clicked by a victim. The issue is resolved in version 4.12.31 by routing 'href' attributes through the standard 'isDangerousUrl' normalization routine.
Affected products
- xdan Jodit Editor < 4.12.31
Timeline
- 2026-06-26: patched: Fixed in version 4.12.31
- 2026-07-31: disclosed: Public advisory and CVE assignment