# CVE-2026-62324: xdan Jodit Editor XSS via incomplete href normalization

Source: https://junglewise.ai/threats/cve-2026-62324-xdan-jodit-editor-xss-via-incomplete-href-normalization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-62324 · Severity: medium · CVSS 5.4 · Published 2026-07-31

Jodit Editor is a popular web-based text editor used in websites to allow users to create and format content. A security flaw in how the editor cleans up web links allows attackers to insert malicious 'javascript:' links that bypass security filters. If a user clicks on one of these links, an attacker could execute unauthorized scripts in the user's browser, potentially leading to account takeover or the theft of sensitive information within that website.

Technologies: [jodit (npm)](https://junglewise.ai/threats/technologies/jodit), [Xdan Jodit Editor](https://junglewise.ai/threats/technologies/jodit-editor). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Xdan](https://junglewise.ai/threats/vendors/xdan).

## Quick answers

**Is CVE-2026-62324 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62324 being exploited in the wild.

**How severe is CVE-2026-62324?** Medium severity, with a CVSS score of 5.4, published 31 July 2026.

**Which products and versions are affected?** jodit (npm) <= 4.12.30, SEMVER:introduced=0,fixed=4.12.31; Xdan Jodit Editor < 4.12.31.

**Is there a fix for CVE-2026-62324?** Yes. jodit (npm): upgrade to 4.12.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62324 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62324?** Check whether you run jodit (npm) or Xdan Jodit Editor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jodit (npm): upgrade to 4.12.31 or later

  ```sh
  npm install jodit@4.12.31
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Jodit Editor due to incomplete normalization in the 'sanitizeHTMLElement' method. While other URL attributes are processed via 'isDangerousUrl', the 'href' attribute was checked using a case-sensitive 'indexOf' call on a trimmed string. This allowed bypasses using mixed-case schemes (e.g., 'JAVASCRIPT:'), leading C0 control bytes (e.g., '\x01javascript:'), or embedded tabs and newlines (e.g., 'java\tscript:'), all of which are resolved as valid 'javascript:' URIs by modern browsers. An attacker with permission to save content can inject these obfuscated links, which execute arbitrary JavaScript in the context of the application's origin when clicked by a victim. The issue is resolved in version 4.12.31 by routing 'href' attributes through the standard 'isDangerousUrl' normalization routine.

## Affected products

- xdan Jodit Editor < 4.12.31

## Identifiers

- CVE-2026-62324
- GHSA-j839-gqq4-gf9j

## Timeline

- 2026-06-26: patched: Fixed in version 4.12.31
- 2026-07-31: disclosed: Public advisory and CVE assignment

## References

- [https://github.com/xdan/jodit/commit/5fba6ef2381d151d7cb8e3c5ad0b9996af0f97b0](https://github.com/xdan/jodit/commit/5fba6ef2381d151d7cb8e3c5ad0b9996af0f97b0)
- [https://github.com/xdan/jodit/releases/tag/4.12.31](https://github.com/xdan/jodit/releases/tag/4.12.31)
- [https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j](https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j)

## Related threats

- [xdan Jodit Editor XSS via SVG and MathML bypass in clean-html](https://junglewise.ai/threats/cve-2026-65841-xdan-jodit-editor-xss-via-svg-and-mathml-bypass-in-clean-html)
- [Jodit Editor Mutation XSS in clean-html sanitizer](https://junglewise.ai/threats/cve-2026-58263-jodit-editor-mutation-xss-in-clean-html-sanitizer)
- [xdan Jodit Editor prototype pollution in Helpers.set](https://junglewise.ai/threats/cve-2026-55886-xdan-jodit-editor-prototype-pollution-in-helpers-set)
- [xdan Jodit Editor prototype pollution in Jodit.configure](https://junglewise.ai/threats/cve-2026-54756-xdan-jodit-editor-prototype-pollution-in-jodit-configure)
- [Jodit Editor cross-site scripting in rich text editor](https://junglewise.ai/threats/cve-2023-42399-jodit-editor-cross-site-scripting-in-rich-text-editor)