Is CVE-2026-62324 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62324 being exploited in the wild.

How severe is CVE-2026-62324?

Medium severity, with a CVSS score of 5.4, published 31 July 2026.

Which products and versions are affected?

jodit (npm) <= 4.12.30, SEMVER:introduced=0,fixed=4.12.31; Xdan Jodit Editor < 4.12.31.

Is there a fix for CVE-2026-62324?

Yes. jodit (npm): upgrade to 4.12.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62324 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-62324?

Check whether you run jodit (npm) or Xdan Jodit Editor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62324: xdan Jodit Editor XSS via incomplete href normalization

Q: Which products and versions are affected?

jodit (npm) <= 4.12.30, SEMVER:introduced=0,fixed=4.12.31; Xdan Jodit Editor < 4.12.31.

Q: Is there a fix for CVE-2026-62324?

Yes. jodit (npm): upgrade to 4.12.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-62324 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-62324?

Check whether you run jodit (npm) or Xdan Jodit Editor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62324 · Severity: medium · CVSS 5.4 · Published 2026-07-31

Jodit Editor is a popular web-based text editor used in websites to allow users to create and format content. A security flaw in how the editor cleans up web links allows attackers to insert malicious 'javascript:' links that bypass security filters. If a user clicks on one of these links, an attacker could execute unauthorized scripts in the user's browser, potentially leading to account takeover or the theft of sensitive information within that website.

Technologies: jodit (npm), Xdan Jodit Editor. Vendors: npm, Xdan.

Quick answers

Is CVE-2026-62324 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62324 being exploited in the wild.
How severe is CVE-2026-62324?: Medium severity, with a CVSS score of 5.4, published 31 July 2026.
Which products and versions are affected?: jodit (npm) <= 4.12.30, SEMVER:introduced=0,fixed=4.12.31; Xdan Jodit Editor < 4.12.31.
Is there a fix for CVE-2026-62324?: Yes. jodit (npm): upgrade to 4.12.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62324 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-62324?: Check whether you run jodit (npm) or Xdan Jodit Editor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jodit (npm): upgrade to 4.12.31 or later
```
npm install jodit@4.12.31
```

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Jodit Editor due to incomplete normalization in the 'sanitizeHTMLElement' method. While other URL attributes are processed via 'isDangerousUrl', the 'href' attribute was checked using a case-sensitive 'indexOf' call on a trimmed string. This allowed bypasses using mixed-case schemes (e.g., 'JAVASCRIPT:'), leading C0 control bytes (e.g., '\x01javascript:'), or embedded tabs and newlines (e.g., 'java\tscript:'), all of which are resolved as valid 'javascript:' URIs by modern browsers. An attacker with permission to save content can inject these obfuscated links, which execute arbitrary JavaScript in the context of the application's origin when clicked by a victim. The issue is resolved in version 4.12.31 by routing 'href' attributes through the standard 'isDangerousUrl' normalization routine.

Affected products

xdan Jodit Editor < 4.12.31

Identifiers

CVE-2026-62324
GHSA-j839-gqq4-gf9j

Timeline

2026-06-26: patched: Fixed in version 4.12.31
2026-07-31: disclosed: Public advisory and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.