CVE-2026-62324: falha de média gravidade em xdan jodit
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.3%
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
xdan · joditCVEs relacionadas — xdan jodit
No mesmo produto, das mais perigosas para as menos.
CVE-2026-55886MEDIUMJodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()EPSS 0.5%CVE-2026-65841MEDIUMJodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitizationEPSS 0.5%CVE-2026-54756MEDIUMJodit Editor: Prototype pollution via Jodit.configure() / ConfigMergeEPSS 0.5%CVE-2026-58263HIGHJodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrierEPSS 0.2%