Moderate severityNVD Advisory· Published Jul 31, 2026· Updated Jul 31, 2026
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
CVE-2026-65841
Description
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
joditnpm | < 4.13.6 | 4.13.6 |
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-45qg-252v-3f7pghsaADVISORY
- github.com/xdan/jodit/commit/49a31f451f6b686f5610022a1d4406ee85138dc5ghsax_refsource_MISCWEB
- github.com/xdan/jodit/releases/tag/4.13.6ghsax_refsource_MISCWEB
- github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7pghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.