SB2026111327 - Inefficient regular expression complexity in Jodit Editor

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111327

SB2026111327 - Inefficient regular expression complexity in Jodit Editor

Published: November 13, 2026

Security Bulletin ID SB2026111327
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by freezing the editor tab or exhausting CPU resources in server-side JSDOM integrations.

The vulnerability exists due to inefficient regular expression complexity in Jodit Editor's HTML detection and related paste and value processing helpers when scanning crafted HTML, causing quadratic backtracking. A remote attacker can trick a victim into pasting clipboard HTML or dropping an HTML file containing long runs of <meta tag openers to stall processing.


Remediation

Install update from vendor's website.

References