Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-65841

Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

xdan jodit

  • < 4.13.6affected

References