Inefficient regular expression complexity in Jodit Editor - #VU166180
Published: November 13, 2026
Vulnerability identifier: #VU166180
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by freezing the editor tab or exhausting CPU resources in server-side JSDOM integrations.
The vulnerability exists due to inefficient regular expression complexity in Jodit Editor's HTML detection and related paste and value processing helpers when scanning crafted HTML, causing quadratic backtracking. A remote attacker can trick a victim into pasting clipboard HTML or dropping an HTML file containing long runs of <meta tag openers to stall processing.
Affected software
Jodit Editor
Remediation
Install security update from vendor's website.
Jodit Editor - update to 4.19.11