CVE-2026-62324: fallo de gravedad media en xdan jodit
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.3%
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
xdan · joditCVEs relacionadas — xdan jodit
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-55886MEDIUMJodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()EPSS 0.5%CVE-2026-65841MEDIUMJodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitizationEPSS 0.5%CVE-2026-54756MEDIUMJodit Editor: Prototype pollution via Jodit.configure() / ConfigMergeEPSS 0.5%CVE-2026-58263HIGHJodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrierEPSS 0.2%