Threats tagged 'ghsa-5957-5c94-3v7w'

Jodit versions prior to 4.12.18 contain a prototype pollution vulnerability in the Jodit.configure(options) API. The vulnerability arises because user-supplied options are merged into the editor configuration without filtering keys that can mutate Object.prototype. This allows an attacker to inject properties into Object.prototype, potentially causing unexpected behavior, logic bypass, denial of service, or other security issues. The issue was fixed in version 4.12.18 by rejecting prototype-mutating keys during configuration merges.