PT-2026-66848 · Unknown · Jodit Editor

CVE-2026-62324 · Published 2026-07-31 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jodit Editor versions prior to 4.12.31

Description The sanitizeHTMLElement function fails to properly normalize javascript: values within href attributes before validating the scheme. While other URL attributes are processed using the isDangerousUrl() function, href is checked using a basic indexOf() method that is case-sensitive and does not remove control bytes or embedded whitespace. This allows attackers to bypass filters using case variants (e.g., JAVASCRIPT:), leading C0 control bytes, or embedded tabs and newlines (e.g., javatscript:). If a victim clicks a stored link rendered by an application, attacker-controlled script can be executed in the page's origin. This issue occurs within the sanitizeHTMLElement function located in src/core/helpers/html/safe-html.ts.

Recommendations Update Jodit Editor to version 4.12.31. As a temporary mitigation, restrict the use of the sanitizeHTMLElement function or implement server-side re-sanitization of editor output before rendering it to users.

Fix

XSS

Weakness Enumeration

CWE-79

CWE-83

Related Identifiers

CVE-2026-62324

GHSA-J839-GQQ4-GF9J

Affected Products

Jodit Editor

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-62324 · Security Note
• https://osv.dev/vulnerability/GHSA-j839-gqq4-gf9j · Vendor Advisory
• https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j · Note
• https://github.com/xdan/jodit/releases/tag/4.12.31 · Note
• https://github.com/xdan/jodit/commit/5fba6ef2381d151d7cb8e3c5ad0b9996af0f97b0 · Note
• https://github.com/xdan/jodit · Note