CVE-2026-65841: Jodit Editor XSS Vulnerability

CVE-2026-65841 Overview

CVE-2026-65841 is a cross-site scripting (XSS) vulnerability in Jodit Editor, a WYSIWYG editor with a built-in file browser and image editor. Versions prior to 4.13.6 fail to normalize foreign element node names in the clean-htmldenyTags filter. A <script> element nested directly inside SVG or MathML content bypasses the sanitizer and remains in editor.value. When the editor loads that content, the script executes in the victim's browser context. The maintainer released a fix in Jodit 4.13.6.

Critical Impact
Attackers who can influence editor content can execute arbitrary JavaScript in the browser of any user who loads that content, enabling session theft and client-side attacks.

Affected Products

Jodit Editor versions prior to 4.13.6
Web applications embedding vulnerable Jodit builds for rich-text editing
Downstream integrations that persist and re-render Jodit editor.value output

Discovery Timeline

2026-07-31 - CVE-2026-65841 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-65841

Vulnerability Analysis

Jodit's HTML sanitizer maintains allow and deny dictionaries keyed by upper-cased tag names. HTML DOM nodes report nodeName in upper case, so the case-sensitive dictionary lookup works for standard HTML. Foreign content, however, preserves original case: an SVG <script> element reports nodeName as "script" rather than "SCRIPT". The filter in src/plugins/clean-html/helpers/visitor/filters/try-remove-node.ts compared the raw nodeName against the upper-cased denyTags map, so nested foreign scripts slipped past sanitization and remained in the serialized editor output. This maps to [CWE-80], improper neutralization of script-related HTML tags.

Root Cause

The root cause is a case-sensitivity mismatch between how the browser reports foreign element node names and how Jodit's sanitizer performs lookups. Because SVG and MathML preserve original case for element names, an attacker-controlled <script> inside <svg> or <math> never matched the deny list entry keyed "SCRIPT".

Attack Vector

An attacker crafts HTML containing an SVG or MathML wrapper with a nested <script> element and delivers it into any workflow that populates Jodit's editor value: a shared draft, a comment, a stored document, or a paste target. When another user loads that content in Jodit, the script executes with the privileges of the hosting page. Exploitation requires user interaction to open or render the malicious content.

typescript

// Patch: src/plugins/clean-html/helpers/visitor/filters/try-remove-node.ts
	deny: IDictionary | false
): boolean {
	if (!Dom.isText(node)) {
-		if (allow && !allow[node.nodeName]) {
+		// The allow/deny hashes are keyed by upper-cased tag name. HTML
+		// `nodeName` is already upper-case, but foreign (SVG/MathML) elements
+		// keep their original case — an SVG `<script>` reports `"script"`, so a
+		// case-sensitive lookup let it slip past `denyTags` and execute. Normalise
+		// to upper case so namespace can't bypass the filter. See
+		// GHSA-45qg-252v-3f7p.
+		const name = node.nodeName.toUpperCase();
+
+		if (allow && !allow[name]) {
			return true;
		}

Source: GitHub Commit 49a31f4

Detection Methods for CVE-2026-65841

Indicators of Compromise

Stored content in application databases containing <svg> or <math> wrappers with nested <script> children
Outbound browser requests to unexpected domains from pages that render Jodit content
Unexpected JavaScript execution or DOM modifications on pages hosting rich-text output

Detection Strategies

Audit persisted rich-text records for foreign-namespace elements enclosing script nodes using pattern matching such as svg[^>]*>\s*<script or math[^>]*>\s*<script
Review application logs and web proxy telemetry for Content-Security-Policy violation reports referencing inline scripts on editor-render pages
Inspect deployed Jodit assets and lock files to identify installations pinned below version 4.13.6

Monitoring Recommendations

Forward browser CSP violation reports to a centralized log source for correlation and alerting
Track anomalous session activity following editor-content views, such as new API tokens issued or profile changes from unusual user agents
Monitor package manifests in CI for the presence of jodit at vulnerable versions

How to Mitigate CVE-2026-65841

Immediate Actions Required

Upgrade Jodit Editor to version 4.13.6 or later across all applications and build pipelines
Sanitize existing stored rich-text data server-side to strip SVG and MathML script nodes before rendering
Enforce a strict Content-Security-Policy that disallows inline script execution on pages that render user-authored HTML

Patch Information

The fix ships in Jodit 4.13.6. The maintainer updated try-remove-node.ts to normalize node.nodeName to upper case before consulting the allow and deny dictionaries, closing the namespace-based bypass. See the GitHub Security Advisory GHSA-45qg-252v-3f7p and the Jodit 4.13.6 Release Notes.

Workarounds

Apply a server-side HTML sanitizer such as DOMPurify to editor output before persistence and before rendering
Deploy a Content-Security-Policy header with script-src 'self' and no unsafe-inline on pages that display editor content
Restrict editor use to trusted authenticated roles until upgrade completes

bash

# Example: pin Jodit to the patched release
npm install jodit@^4.13.6

# Example CSP header for pages rendering editor output
# Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'