CVE-2026-62324: Jodit Editor XSS Vulnerability

CVE-2026-62324 Overview

CVE-2026-62324 is a stored cross-site scripting (XSS) vulnerability in Jodit Editor, a WYSIWYG editor with a built-in file browser and image editor. The flaw resides in the sanitizeHTMLElement method, which fails to normalize javascript:href values before checking the scheme. Attackers can bypass the filter using case variants such as JAVASCRIPT:, control-byte prefixes, or embedded tabs and newlines like java\tscript:. A victim who clicks a stored link rendered by an application executes attacker-controlled script in their browser session. The issue is fixed in version 4.12.31 and is classified as [CWE-79].

Critical Impact
Stored javascript: URIs in Jodit-rendered content execute arbitrary script in victim browsers upon click, enabling session theft, defacement, and cross-user actions.

Affected Products

Jodit Editor versions prior to 4.12.31
Web applications embedding Jodit Editor for user-generated content
Downstream integrations relying on safeJavaScriptLink sanitization

Discovery Timeline

2026-07-31 - CVE-2026-62324 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-62324

Vulnerability Analysis

Jodit's HTML sanitizer inspects anchor href values to block script execution. The pre-patch check called href.trim().indexOf('javascript') === 0, a case-sensitive substring test performed on the raw attribute value. Browsers, however, resolve URLs after lowercasing the scheme and stripping ASCII whitespace and control characters. This mismatch between sanitizer parsing and browser parsing creates the bypass primitive tracked as CVE-2026-62324.

An attacker who can persist HTML rendered by a Jodit-integrated application stores an anchor whose href uses an obfuscated scheme. When another user clicks the link, the browser normalizes the URI to javascript: and executes the payload in the site's origin. Because the payload is stored, the impact spans every user who renders and interacts with the affected content.

Root Cause

The sanitizer applied isDangerousUrl normalization to most URL attributes but not to anchor href values. Instead, it used a bare indexOf check against the trimmed string. That check did not lowercase the input, did not strip control bytes (for example \\x01javascript:), and did not remove embedded tabs or newlines inside the scheme token.

Attack Vector

Exploitation requires low privileges to submit content and user interaction to click the malicious link. The rendered payload triggers script execution in the victim's browser context, yielding a scope change under the site's origin.

typescript

// Security patch in src/core/helpers/html/safe-html.ts
// Route href through isDangerousUrl to block obfuscated javascript: links
 		effected = true;
 	}
 
+	const tagName = elm.nodeName.toLowerCase();
 	const href = elm.getAttribute('href');
 
-	if (safeJavaScriptLink && href && href.trim().indexOf('javascript') === 0) {
+	// Neutralize executable-scheme `href`s with the same normalization used for
+	// every other URL attribute (`isDangerousUrl`), which strips control bytes,
+	// tabs and newlines and lowercases before matching the scheme. The previous
+	// bare `href.trim().indexOf('javascript') === 0` was case-sensitive and
+	// missed `JAVASCRIPT:`, a leading control byte, or a tab/newline inside the
+	// scheme (e.g. `java\tscript:`) — all of which the browser still resolves to
+	// `javascript:` on click. See GHSA-j839-gqq4-gf9j.
+	if (safeJavaScriptLink && href && isDangerousUrl(href, tagName)) {
 		attr(elm, 'href', location.protocol + '//' + href);
 		effected = true;
 	}

Source: GitHub Commit 5fba6ef

Detection Methods for CVE-2026-62324

Indicators of Compromise

Stored HTML content containing anchors with href values matching case variants of javascript: such as JavaScript: or JAVASCRIPT:
Anchor attributes containing control bytes, tabs, or newlines inside the scheme, for example java\tscript: or \\x01javascript:
Application logs showing outbound events triggered from anchor click handlers on user-generated content

Detection Strategies

Scan persistence layers (databases, object storage) for stored HTML where anchor href values normalize to javascript: after lowercasing and whitespace stripping
Deploy Content Security Policy (CSP) reports to surface inline script execution attempts originating from user content
Add server-side validation that rejects any href failing a strict URL scheme allowlist (http, https, mailto)

Monitoring Recommendations

Monitor Jodit dependency versions across build pipelines and flag any package resolving below 4.12.31
Alert on browser-side CSP violations referencing script-src inline execution from anchor click origins
Review web application firewall (WAF) telemetry for POST bodies containing obfuscated javascript: scheme patterns

How to Mitigate CVE-2026-62324

Immediate Actions Required

Upgrade Jodit Editor to version 4.12.31 or later in all applications that render user-authored content
Audit stored content for anchors carrying javascript: schemes in any obfuscated form and remove or rewrite them
Enforce a strict CSP that disables inline script and restricts script-src to trusted origins

Patch Information

The fix routes anchor href values through isDangerousUrl, which lowercases the input, strips control bytes, tabs, and newlines before matching the scheme. Details are published in GitHub Security Advisory GHSA-j839-gqq4-gf9j and shipped in Jodit Release 4.12.31.

Workarounds

Apply server-side HTML sanitization (for example DOMPurify with a scheme allowlist) after Jodit output but before persistence or rendering
Deny anchor href values that do not begin with http://, https://, mailto:, or a relative path after Unicode normalization
Disable link creation entirely in Jodit configuration for contexts where user-submitted anchors are not required

bash

# Update Jodit Editor via npm
npm install jodit@^4.12.31

# Verify the installed version
npm ls jodit