The vulnerability in xdan Jodit (npm package) versions before 4.12.18 involves improper control of object prototype modification (CWE-1321). Specifically, the Jodit.configure(options) method and its internal helpers (ConfigMerge and ConfigProto) merge user-supplied options into the editor configuration without filtering out keys such as __proto__, constructor, and prototype. This allows an attacker to perform prototype pollution by injecting properties into Object.prototype, which can lead to unexpected property injection, logic bypass, denial of service, or secondary security issues. The vulnerability was responsibly reported and fixed in version 4.12.18 by rejecting these prototype-mutating keys at every merge level.

Applications that use Jodit and pass user-controlled or partially user-controlled data into Jodit.configure() are vulnerable to prototype pollution. This can result in unexpected property injection into Object.prototype, potentially causing logic bypass, denial of service, or other secondary security impacts. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts.

A patch is available and was released in Jodit version 4.12.18. Users should upgrade to version 4.12.18 or later to mitigate this vulnerability. The fix rejects the prototype-mutating keys (__proto__, constructor, prototype) at every merge level in the configuration process. No additional mitigation steps are required if the upgrade is applied.