CVE-2026-65841mediumCWE-80

CVE-2026-65841: falha de média gravidade em xdan jodit

Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Publicada em

Seguir esta CVE+ Monitorar jodit+ Monitorar jodit

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
xdan · jodit
CVEs relacionadas — xdan jodit

No mesmo produto, das mais perigosas para as menos.

CVE-2026-55886MEDIUMJodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()EPSS 0.5%CVE-2026-54756MEDIUMJodit Editor: Prototype pollution via Jodit.configure() / ConfigMergeEPSS 0.5%CVE-2026-62324MEDIUMJodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSSEPSS 0.3%CVE-2026-58263HIGHJodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrierEPSS 0.2%