CVE-2026-55886 is a prototype pollution vulnerability in the Jodit Editor, a WYSIWYG editor written in TypeScript. The vulnerability exists in the Jodit.modules.Helpers.set(chain, value, obj) method, which traverses a dot-separated key chain to set a value but does not filter out keys that can mutate the Object prototype such as __proto__, constructor, or prototype. If an application passes user-controlled or partially user-controlled key paths to this method, an attacker can modify Object.prototype, potentially causing unexpected behavior, logic bypass, denial of service, or other security issues. This vulnerability affects all versions prior to 4.12.26 and has been fixed in 4.12.26.

An attacker able to supply or influence the key path argument to Jodit.modules.Helpers.set() can perform prototype pollution by modifying Object.prototype. This can result in unexpected property injection, logic bypass, denial of service, or other secondary security impacts depending on how the application uses the affected object. The vulnerability requires the attacker to control or partially control the key path input. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, and partial attack and user interaction requirements.

Upgrade Jodit Editor to version 4.12.26 or later, where this prototype pollution vulnerability has been fixed. Applications should avoid passing user-controlled or partially user-controlled key paths to Jodit.modules.Helpers.set() until upgraded. Patch status is confirmed fixed in 4.12.26.