Jodit Editor, a TypeScript-based WYSIWYG editor, improperly merges user-supplied configuration options without filtering keys that can mutate the JavaScript Object prototype. Specifically, the Jodit.configure(options) method and internal helpers ConfigMerge and ConfigProto allow a payload nested under existing plain-object options (e.g., controls) to modify Object.prototype. This Prototype Pollution vulnerability affects all versions prior to 4.12.18. Applications that pass user-controlled or partially user-controlled data into Jodit.configure() are vulnerable. The vulnerability is tracked as CVE-2026-54756 and classified under CWE-1321. It has a CVSS 4.0 score of 6.3 (medium severity).

An attacker who can supply or influence the configuration options passed to Jodit.configure() may exploit this vulnerability to perform Prototype Pollution. This can lead to unexpected behavior in the application due to modification of Object.prototype, potentially affecting application logic or security controls. The vulnerability does not require privileges or user interaction but has low to limited impact on confidentiality, integrity, and availability as per the CVSS vector.

Upgrade Jodit Editor to version 4.12.18 or later, where this Prototype Pollution vulnerability has been fixed. Until upgraded, avoid passing user-controlled or partially user-controlled data directly into Jodit.configure(). Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the description confirms the issue was fixed in 4.12.18.