SB2026111328 - Multiple vulnerabilities in Jodit Editor

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute scripts in the application's origin, access victims' sessions, and act as victims.

The vulnerability exists due to incomplete URL scheme filtering in Jodit Editor's safeHTML/sanitizeHTMLElement sanitizer when processing SVG animation attributes that modify link destinations at runtime. A remote attacker can embed <animate attributeName="href" values="javascript:alert(document.domain)" begin="0s" fill="freeze"/> inside an SVG link in stored HTML and entice a victim to click it in the editor or another view rendering that content to execute scripts.

2) Prototype pollution (CVE-ID: N/A)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify Object.prototype across the JavaScript runtime and cause a denial of service.

The vulnerability exists due to prototype pollution in Jodit Editor's extendLang() helper when merging untrusted language dictionaries without filtering dangerous keys. A remote attacker can supply a language pack containing {"__proto__": {"toString": 1}} through downstream application or plugin code to overwrite an inherited method and disrupt ordinary object string coercion.

Remediation

Install update from vendor's website.

References

• https://github.com/xdan/jodit/security/advisories/GHSA-6wrw-v5gj-6xg7
• https://github.com/xdan/jodit/security/advisories/GHSA-6gxg-6pj3-m22j