EUVD-2026-41140
GHSA-rxcw-mc6f-6hr3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attacker-supplied HTML reaches the editor remotely with no auth and the auto-firing handler needs no interaction (AV:N/AC:L/PR:N/UI:N); injected script crosses into the app DOM (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value, potentially causing Mutation XSS. When an application supplies attacker-influenced HTML to the editor's value-set or insertion paths, the sanitized output still contains a live <img ... onload=...> (or another non-onerror handler such as onfocus). A consumer that renders that output (element.innerHTML = editor.value) executes the handler with no user interaction. This issue has been fixed in version 4.12.28.
AnalysisAI
Mutation XSS in Jodit Editor (xdan/jodit) before 4.12.28 lets attacker-influenced HTML slip a live, no-interaction event handler past the built-in clean-html sanitizer. A MathML/<style> carrier hides a dangerous element from the sanitizer's element walk, so the sanitized editor value still contains a working handler such as <img onload=...> or onfocus; any consumer that renders editor.value via innerHTML executes attacker JavaScript without user interaction. No public exploit identified at time of analysis, and the flaw is fixed in 4.12.28.
Technical ContextAI
Jodit is an open-source WYSIWYG rich-text editor written in pure TypeScript (CPE cpe:2.3:a:xdan:jodit) that ships its own clean-html sanitizer to strip dangerous markup before content is stored or re-rendered. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) in a specific, subtle form: sanitizer bypass via HTML parsing/mutation differentials. MathML and <style> elements are parsed by the browser differently from how Jodit's sanitizer performs its element walk, so a dangerous node can be 'carried' inside these contexts, escape enumeration, and then be re-materialized by the browser's own DOM normalization (mutation) when the value is later assigned to element.innerHTML. Because the surviving vectors rely on non-onerror handlers like onload and onfocus that fire automatically, exploitation needs no victim click.
RemediationAI
Vendor-released patch: upgrade Jodit to version 4.12.28 or later, which fixes the sanitizer bypass; update the npm dependency (e.g. bump jodit to ^4.12.28) and redeploy per the advisory at https://github.com/xdan/jodit/security/advisories/GHSA-rxcw-mc6f-6hr3. If you cannot upgrade immediately, do not treat Jodit's clean-html output as trusted: run editor.value through a robust independent sanitizer such as DOMPurify before assigning it to innerHTML, which neutralizes the surviving onload/onfocus handlers at the cost of an extra processing step and possible stripping of legitimate embedded markup. As a further control, avoid rendering user-submitted editor content via raw innerHTML in security-sensitive contexts and enforce a Content-Security-Policy that blocks inline event-handler execution (script-src without 'unsafe-inline'), accepting that a strict CSP may break other inline scripts in the app and require refactoring.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today