Cross-site scripting in Jodit Editor - #VU164393
Published: November 10, 2026
Vulnerability identifier: #VU164393
CSH Severity: High
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript in a victim's session within the embedding page's origin.
The vulnerability exists due to inconsistent HTML parsing in Jodit Editor's value sanitizer when HTML sanitized with scripting disabled is reparsed with scripting enabled, causing mutation cross-site scripting. A remote attacker can supply <p>a</p><noscript><style></noscript><img src=1 onerror="…"></style></noscript><p>b</p> as content later assigned to editor.value and induce a victim to open it, activating an event handler before asynchronous cleaning to execute JavaScript.
Affected software
Jodit Editor
Remediation
Install security update from vendor's website.
Jodit Editor - update to 4.17.3