SB20261110280 - Cross-site scripting in Jodit Editor

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110280

SB20261110280 - Cross-site scripting in Jodit Editor

Published: November 10, 2026

Security Bulletin ID SB20261110280
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary JavaScript in a victim's session within the embedding page's origin.

The vulnerability exists due to inconsistent HTML parsing in Jodit Editor's value sanitizer when HTML sanitized with scripting disabled is reparsed with scripting enabled, causing mutation cross-site scripting. A remote attacker can supply <p>a</p><noscript><style></noscript><img src=1 onerror="…"></style></noscript><p>b</p> as content later assigned to editor.value and induce a victim to open it, activating an event handler before asynchronous cleaning to execute JavaScript.


Remediation

Install update from vendor's website.

References