The vulnerability (CVE-2026-55886) in xdan jodit's Jodit.modules.Helpers.set(chain, value, obj) method allows prototype pollution by walking a dot-separated key path without filtering out keys that mutate Object.prototype, such as __proto__, constructor, or prototype. This enables an attacker to inject or modify properties on Object.prototype, potentially causing logic bypass, denial of service, or other secondary security impacts. The issue affects all versions prior to 4.12.26. The fix implemented in 4.12.26 rejects any chain segments that include these prototype-mutating keys, preventing the pollution.

Applications using vulnerable versions of jodit that pass user-controlled or partially user-controlled key paths to Jodit.modules.Helpers.set() may be exposed to prototype pollution. This can result in unexpected property injection on Object.prototype, which may lead to logic bypass, denial of service, or other security issues depending on how the polluted properties are used within the application.

A patch is available in jodit version 4.12.26 that addresses this vulnerability by rejecting any key paths containing __proto__, constructor, or prototype segments. Users should upgrade to version 4.12.26 or later to remediate this issue. No additional mitigation is required if the upgrade is applied.