EUVD-2026-41139
GHSA-5957-5c94-3v7w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects AT:P precondition (user-controlled config required); S:C because prototype pollution crosses object boundaries into the broader JavaScript runtime environment.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.18, Jodit.configure(options) - and the internal ConfigMerge / ConfigProto helpers - merged user-supplied options into the editor configuration without filtering prototype-mutating keys, potentially causing a Prototype Pollution vulnerability. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype. Applications that pass user-controlled or partially user-controlled configuration into Jodit.configure() may be vulnerable. This issue was fixed in version 4.12.18.
AnalysisAI
Prototype Pollution in Jodit Editor (versions prior to 4.12.18) allows network-reachable attackers to mutate Object.prototype by supplying crafted configuration payloads to Jodit.configure(), exploiting unfiltered merging in the internal ConfigMerge and ConfigProto helpers. Specifically, keys such as __proto__ or constructor nested inside legitimate option namespaces like controls can propagate to the global JavaScript prototype chain, corrupting runtime behavior for all JavaScript executing in the same environment. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV; however, exploitation is contingent on the host application forwarding user-controlled input into Jodit.configure(), a pattern common in configurable WYSIWYG deployments.
Technical ContextAI
CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes - Prototype Pollution) describes the root cause: JavaScript's prototype inheritance allows any object traversal that reaches __proto__, constructor, or prototype keys to silently modify the shared Object.prototype, making injected properties appear on every plain object in the process. Jodit Editor (CPE: cpe:2.3:a:xdan:jodit:*:*:*:*:*:*:*:*) is a TypeScript WYSIWYG rich-text editor whose configuration system uses recursive object merging via ConfigMerge and ConfigProto internal helpers. These helpers iterate user-supplied option trees and assign values without blocklisting or sanitizing prototype-mutating keys. The attack surface is the Jodit.configure(options) API - if an attacker's data reaches this call as a plain JavaScript object, the merge logic propagates dangerous keys upward through the prototype chain. Prototype pollution is particularly impactful in server-side Node.js contexts (where the pollution persists across requests) but also causes behavioral anomalies in browser environments where many scripts share the same global object prototype.
RemediationAI
Upgrade Jodit Editor to version 4.12.18 or later, which filters prototype-mutating keys in ConfigMerge and ConfigProto; the fix is confirmed by the GitHub Security Advisory GHSA-5957-5c94-3v7w at https://github.com/xdan/jodit/security/advisories/GHSA-5957-5c94-3v7w. If an immediate upgrade is not possible, the primary compensating control is to sanitize or validate configuration objects before passing them to Jodit.configure() - specifically, strip or reject keys named __proto__, constructor, and prototype at every nesting level using a recursive blocklist or a safe-merge library such as lodash's _.merge with prototype pollution protection enabled. Additionally, avoid passing any user-controlled JSON directly as editor options; instead, allowlist only known-safe configuration keys on the server before forwarding them to the client. In server-side Node.js contexts, consider running Jodit initialization in an isolated vm.Context to contain prototype pollution to a sandboxed scope, though this adds significant complexity and performance overhead.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today