Executive brief
Jodit Editor is a popular web-based text editor used in websites to allow users to create and format content. A security flaw in its content filtering system allows malicious scripts to be hidden inside images or mathematical formulas (SVG or MathML). If an attacker successfully saves this malicious content, it could execute in the browsers of other users or administrators, potentially leading to unauthorized actions or data theft.
Technical details
A cross-site scripting (XSS) vulnerability exists in Jodit Editor's 'clean-html' sanitizer prior to version 4.13.6. The 'denyTags' filter fails to normalize the case of node names for elements within foreign namespaces, such as SVG or MathML. While standard HTML tags are converted to uppercase (e.g., 'SCRIPT'), foreign-namespaced tags retain their original case (e.g., 'script'), allowing them to bypass the blacklist. An attacker can exploit this by nesting a script element directly inside an SVG or MathML container, which will then be preserved in the editor's value and executed when the content is loaded. This issue is resolved in version 4.13.6 by normalizing all tag names to uppercase before filtering.
Affected products
- xdan Jodit Editor < 4.13.6
Timeline
- 2026-07-21: patched: Version 4.13.6 released
- 2026-07-22: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE-2026-65841 published to NVD