Threats affecting pkg:npm/jodit

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.

Jodit versions prior to 4.12.18 contain a prototype pollution vulnerability in the Jodit.configure(options) API. The vulnerability arises because user-supplied options are merged into the editor configuration without filtering keys that can mutate Object.prototype. This allows an attacker to inject properties into Object.prototype, potentially causing unexpected behavior, logic bypass, denial of service, or other security issues. The issue was fixed in version 4.12.18 by rejecting prototype-mutating keys during configuration merges.

A prototype pollution vulnerability exists in the xdan jodit package versions prior to 4.12.26. The vulnerability arises from the Jodit.modules.Helpers.set() function, which improperly allows modification of Object.prototype via specially crafted key paths containing __proto__, constructor, or prototype. This can lead to unexpected property injection and potential security issues. The vulnerability is fixed in version 4.12.26 by rejecting such prototype-mutating keys.