# CVE-2026-65841: xdan Jodit Editor XSS via SVG and MathML bypass in clean-html

Source: https://junglewise.ai/threats/cve-2026-65841-xdan-jodit-editor-xss-via-svg-and-mathml-bypass-in-clean-html  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-65841 · Severity: medium · CVSS 4 · Published 2026-07-31

Jodit is a popular JavaScript WYSIWYG editor used in web applications to let users create and edit rich content. A flaw in its HTML sanitization allows attackers to embed executable scripts inside SVG graphics that are then stored by the application. When an administrator or other user later views or edits that content, the embedded script runs in their browser, potentially leading to account compromise or data theft.

Technologies: [jodit (npm)](https://junglewise.ai/threats/technologies/jodit), [Xdan Jodit Editor](https://junglewise.ai/threats/technologies/jodit-editor). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Xdan](https://junglewise.ai/threats/vendors/xdan).

## Quick answers

**Is CVE-2026-65841 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65841 being exploited in the wild.

**How severe is CVE-2026-65841?** Medium severity, with a CVSS score of 4, published 31 July 2026.

**Which products and versions are affected?** jodit (npm) < 4.13.6, SEMVER:introduced=0,fixed=4.13.6; Xdan Jodit Editor < 4.13.6.

**Is there a fix for CVE-2026-65841?** Yes. jodit (npm): upgrade to 4.13.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65841 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65841?** Check whether you run jodit (npm) or Xdan Jodit Editor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jodit (npm): upgrade to 4.13.6 or later

  ```sh
  npm install jodit@4.13.6
  ```


## Technical details

The vulnerability is an improper HTML sanitization (CWE-80) in Jodit's clean-html module. The deny/allow tag filter normalizes tag names to uppercase before matching against the denyTags list, but SVG and MathML elements are foreign-namespaced and preserve their original lowercase names in the DOM (node.nodeName). A script element nested directly inside an svg element reports "script" instead of "SCRIPT", bypassing the default denyTags filter. The malicious script survives in the editor value and serialized output, executing when the content is loaded back into Jodit or rendered on a page. Attack requires user interaction (loading or editing content in the editor) but no authentication. The fix (version 4.13.6) normalizes tag names to uppercase before filter matching, preventing namespace-based bypass while still respecting allowTags configuration. Server-side HTML sanitization provides interim mitigation.

## Affected products

- xdan jodit < 4.13.6

## Identifiers

- CVE-2026-65841
- GHSA-45qg-252v-3f7p

## Timeline

- 2026-07-31: disclosed
- 2026-07-22: patched: Fixed in version 4.13.6

## References

- [https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p](https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p)
- [https://github.com/xdan/jodit/commit/49a31f451f6b686f5610022a1d4406ee85138dc5](https://github.com/xdan/jodit/commit/49a31f451f6b686f5610022a1d4406ee85138dc5)
- [https://github.com/xdan/jodit](https://github.com/xdan/jodit)
- [https://github.com/xdan/jodit/releases/tag/4.13.6](https://github.com/xdan/jodit/releases/tag/4.13.6)

## Related threats

- [xdan Jodit Editor XSS via incomplete href normalization](https://junglewise.ai/threats/cve-2026-62324-xdan-jodit-editor-xss-via-incomplete-href-normalization)
- [Jodit Editor Mutation XSS in clean-html sanitizer](https://junglewise.ai/threats/cve-2026-58263-jodit-editor-mutation-xss-in-clean-html-sanitizer)
- [xdan Jodit Editor prototype pollution in Helpers.set](https://junglewise.ai/threats/cve-2026-55886-xdan-jodit-editor-prototype-pollution-in-helpers-set)
- [xdan Jodit Editor prototype pollution in Jodit.configure](https://junglewise.ai/threats/cve-2026-54756-xdan-jodit-editor-prototype-pollution-in-jodit-configure)
- [Jodit Editor cross-site scripting in rich text editor](https://junglewise.ai/threats/cve-2023-42399-jodit-editor-cross-site-scripting-in-rich-text-editor)