EUVD-2026-41138
GHSA-vpmm-x3fm-qr5c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector applies when user input reaches the function; AC:H because a specific vulnerable code path in the consuming application is required; S:C because Object.prototype pollution affects the entire runtime beyond the immediate component.
Primary rating from Vendor (https://github.com/xdan/jodit).
CVSS VectorVendor: https://github.com/xdan/jodit
Lifecycle Timeline
3DescriptionCVE.org
Summary
Jodit.modules.Helpers.set(chain, value, obj) walks the dot-separated chain, creating and following each path segment, without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype (prototype pollution).
Affected
- Package:
jodit(npm) - Versions:
< 4.12.26 - Public API:
Jodit.modules.Helpers.set(chain, value, obj)
Proof of Concept
const { Jodit } = require('jodit');
delete Object.prototype.polluted;
Jodit.modules.Helpers.set('__proto__.polluted', 'yes', {});
console.log(({}).polluted); // "yes" (before the fix)
delete Object.prototype.polluted;Impact
Applications that pass a user-controlled or partially user-controlled key path into Jodit.modules.Helpers.set() could be vulnerable to prototype pollution (CWE-1321): unexpected property injection, logic bypass, denial of service, or secondary security issues.
Patch
Fixed in 4.12.26 by rejecting any chain whose segments include __proto__, constructor, or prototype, reusing the same guard introduced for Jodit.configure() in 4.12.18.
Credit
Responsibly reported by Junming Wu.
AnalysisAI
Prototype pollution in the Jodit WYSIWYG editor npm package (versions < 4.12.26) allows mutation of Object.prototype via the public helper API Jodit.modules.Helpers.set(). When an application passes user-controlled or partially user-controlled key paths to this function, an attacker can inject arbitrary properties into the global Object.prototype, enabling logic bypass, denial of service, or secondary security issues throughout the entire JavaScript runtime. A proof-of-concept is publicly available in the GitHub advisory (GHSA-vpmm-x3fm-qr5c); no public exploit identified at time of analysis beyond this PoC, and no CISA KEV listing exists.
Technical ContextAI
Jodit is a popular open-source WYSIWYG rich-text editor distributed via npm (pkg:npm/jodit). The vulnerable function, Jodit.modules.Helpers.set(chain, value, obj), accepts a dot-separated key path string and walks each segment to set a nested property. The root cause (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes) is the absence of a denylist check for prototype-mutating path segments - specifically __proto__, constructor, and prototype. Because JavaScript property assignment via bracket notation (e.g., obj["__proto__"]["key"] = val) resolves against the object's prototype chain, a crafted chain reaches Object.prototype and pollutes it globally within the Node.js process or browser runtime. Notably, a similar guard was already introduced for Jodit.configure() in version 4.12.18, confirming awareness of this attack class within the project; the same sanitization was simply not applied to the Helpers.set() API until 4.12.26.
RemediationAI
Vendor-released patch: jodit 4.12.26. Upgrade the jodit npm package to version 4.12.26 or later using npm install jodit@latest or yarn add jodit@latest; the fix rejects any chain argument whose dot-separated segments include __proto__, constructor, or prototype. If immediate upgrade is not feasible, the primary compensating control is to audit all call sites of Jodit.modules.Helpers.set() and ensure the chain argument is never derived from user-supplied, URL-encoded, or externally-fetched data; replace with a hardcoded or validated allowlist of permitted key paths. Additionally, consider adding an application-layer sanitization wrapper that blocks prototype-polluting keys before they reach any dynamic property-setting utility. These compensating controls do not eliminate the vulnerability but prevent the reachable attack surface until patching is completed. Advisory: https://github.com/xdan/jodit/security/advisories/GHSA-vpmm-x3fm-qr5c.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today