EUVD-2026-51622
GHSA-45qg-252v-3f7p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered stored XSS requiring write access to editor (PR:L) and victim page load (UI:R); scope changes as script runs in victim's session.
Primary rating from Vendor (https://github.com/xdan/jodit).
CVSS VectorVendor: https://github.com/xdan/jodit
Lifecycle Timeline
3DescriptionCVE.org
A <script> element placed directly inside an <svg> (or MathML) container was not removed by Jodit's clean-html sanitizer.
The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names - an SVG script reports "script", not "SCRIPT" - so the default denyTags list (which includes script) did not match it. The script therefore survived in the editor value and serialized output, where it could execute when the content was loaded back into a page or editor.
Proof of concept
<svg xmlns="http://www.w3.org/2000/svg" width="400" height="400" viewBox="0 0 124 124">
<rect width="124" height="124" rx="24" fill="#000000"></rect>
<script type="text/javascript">alert(document.domain);</script>
</svg>Load the payload into the editor (e.g. via source mode) and the <script> is preserved in editor.value and executes.
Impact
Stored / DOM cross-site scripting. An application that persists editor output and later renders or re-opens it in Jodit can have attacker-supplied script run in a victim's (e.g. an administrator's) authenticated browser context.
Patch
Fixed in 4.13.6: the deny/allow lookup now normalises the tag name to upper case before matching, so a foreign namespace can no longer bypass the filter, while allowTags is still honoured.
Workaround
Upgrade to 4.13.6 or later. Server-side sanitization of stored HTML mitigates in the interim.
Credit
Reported by Roman Kis (@CrownKingClown).
AnalysisAI
Stored and DOM cross-site scripting in the Jodit WYSIWYG editor (npm, all versions before 4.13.6) allows attacker-supplied JavaScript to survive the clean-html sanitizer by exploiting a case-sensitivity flaw in the deny/allow tag filter. SVG- and MathML-namespaced elements return lowercase nodeName values, while the denyTags hash is keyed by uppercase strings, so a <script> nested inside <svg> reports 'script' instead of 'SCRIPT' and passes the filter unblocked. A publicly disclosed proof-of-concept exists; the vulnerability is not listed in CISA KEV.
Technical ContextAI
Jodit (pkg:npm/jodit) is a TypeScript/JavaScript WYSIWYG HTML editor widely embedded in web admin panels and content management systems. Its clean-html plugin traverses the editor DOM and removes disallowed elements using a hash-keyed deny/allow list, with tags stored in uppercase. The root cause (CWE-80: Improper Neutralization of Script-Related HTML Tags) is that the HTML DOM specification requires foreign-namespace elements - those in SVG or MathML namespaces - to preserve the original case of their nodeName. An SVG <script> therefore surfaces as 'script', not 'SCRIPT', causing the case-sensitive hash lookup in try-remove-node.ts to silently miss the match and leave the script intact in the serialized editor output. The patch in commit 49a31f451f normalizes nodeName via .toUpperCase() before all hash lookups, closing the bypass for both denyTags and allowTags comparisons.
RemediationAI
Upgrade the Jodit npm package to version 4.13.6 or later, the vendor-released patch that normalizes tag names to uppercase before deny/allow filter matching. The release is available at https://github.com/xdan/jodit/releases/tag/4.13.6 and the exact fix commit is https://github.com/xdan/jodit/commit/49a31f451f6b686f5610022a1d4406ee85138dc5. As a compensating control prior to patching, apply server-side HTML sanitization to all editor-generated content before persisting or re-rendering it - libraries such as DOMPurify (server-side via jsdom) or sanitize-html with SVG restrictions enabled will strip SVG-embedded scripts regardless of Jodit's client-side behavior; note that server-side sanitizers introduce processing overhead and may alter legitimate SVG content. Additionally, restricting Jodit's source/raw HTML input mode to trusted roles reduces attacker-controlled input surface but does not eliminate the vulnerability if any code path allows raw HTML ingestion.
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today