Is there a patch available for CVE-2026-55886?

Yes, a patch is available for CVE-2026-55886. Update the affected software to the latest version immediately.

Jodit Editor CVE-2026-55886

Q: What is the CVSS score of CVE-2026-55886?

CVE-2026-55886 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

Q: Which versions of Jodit Editor are affected by CVE-2026-55886?

Prototype pollution in the Jodit WYSIWYG editor npm package (versions < 4.12.26) allows mutation of Object.prototype via the public helper API Jodit.modules.Helpers.set().. A patch is available.

EUVD-2026-41138 MEDIUM

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-06-18 https://github.com/xdan/jodit

GHSA-vpmm-x3fm-qr5c

Prototype Pollution Node.js Denial Of Service

6.3

CVSS 4.0 · Vendor: https://github.com/xdan/jodit

Severity by source

Vendor (https://github.com/xdan/jodit) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network vector applies when user input reaches the function; AC:H because a specific vulnerable code path in the consuming application is required; S:C because Object.prototype pollution affects the entire runtime beyond the immediate component.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (https://github.com/xdan/jodit).

CVSS VectorVendor: https://github.com/xdan/jodit

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 01, 2026 - 21:22 NVD

6.3 (MEDIUM)

Source Code Evidence Fetched

Jun 18, 2026 - 14:06 vuln.today

Analysis Generated

Jun 18, 2026 - 14:06 vuln.today

DescriptionCVE.org

Summary

Jodit.modules.Helpers.set(chain, value, obj) walks the dot-separated chain, creating and following each path segment, without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype (prototype pollution).

Affected

Package: jodit (npm)
Versions: < 4.12.26
Public API: Jodit.modules.Helpers.set(chain, value, obj)

Proof of Concept

const { Jodit } = require('jodit');
delete Object.prototype.polluted;
Jodit.modules.Helpers.set('__proto__.polluted', 'yes', {});
console.log(({}).polluted); // "yes" (before the fix)
delete Object.prototype.polluted;

Impact

Applications that pass a user-controlled or partially user-controlled key path into Jodit.modules.Helpers.set() could be vulnerable to prototype pollution (CWE-1321): unexpected property injection, logic bypass, denial of service, or secondary security issues.

Patch

Fixed in 4.12.26 by rejecting any chain whose segments include __proto__, constructor, or prototype, reusing the same guard introduced for Jodit.configure() in 4.12.18.

Credit

Responsibly reported by Junming Wu.

AnalysisAI

Prototype pollution in the Jodit WYSIWYG editor npm package (versions < 4.12.26) allows mutation of Object.prototype via the public helper API Jodit.modules.Helpers.set(). When an application passes user-controlled or partially user-controlled key paths to this function, an attacker can inject arbitrary properties into the global Object.prototype, enabling logic bypass, denial of service, or secondary security issues throughout the entire JavaScript runtime. A proof-of-concept is publicly available in the GitHub advisory (GHSA-vpmm-x3fm-qr5c); no public exploit identified at time of analysis beyond this PoC, and no CISA KEV listing exists.

Technical ContextAI

Jodit is a popular open-source WYSIWYG rich-text editor distributed via npm (pkg:npm/jodit). The vulnerable function, Jodit.modules.Helpers.set(chain, value, obj), accepts a dot-separated key path string and walks each segment to set a nested property. The root cause (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes) is the absence of a denylist check for prototype-mutating path segments - specifically __proto__, constructor, and prototype. Because JavaScript property assignment via bracket notation (e.g., obj["__proto__"]["key"] = val) resolves against the object's prototype chain, a crafted chain reaches Object.prototype and pollutes it globally within the Node.js process or browser runtime. Notably, a similar guard was already introduced for Jodit.configure() in version 4.12.18, confirming awareness of this attack class within the project; the same sanitization was simply not applied to the Helpers.set() API until 4.12.26.

RemediationAI

Vendor-released patch: jodit 4.12.26. Upgrade the jodit npm package to version 4.12.26 or later using npm install jodit@latest or yarn add jodit@latest; the fix rejects any chain argument whose dot-separated segments include __proto__, constructor, or prototype. If immediate upgrade is not feasible, the primary compensating control is to audit all call sites of Jodit.modules.Helpers.set() and ensure the chain argument is never derived from user-supplied, URL-encoded, or externally-fetched data; replace with a hardcoded or validated allowlist of permitted key paths. Additionally, consider adding an application-layer sanitization wrapper that blocks prototype-polluting keys before they reach any dynamic property-setting utility. These compensating controls do not eliminate the vulnerability but prevent the reachable attack surface until patching is completed. Advisory: https://github.com/xdan/jodit/security/advisories/GHSA-vpmm-x3fm-qr5c.