Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype (prototype pollution).
jodit's sanitizeHTMLElement neutralizes a javascript: href using a bare href.trim().indexOf('javascript') === 0 check. This omits the normalization jodit applies to every other URL attribute: isDangerousUrl strips control bytes with value.replace(/[\u0000-\u0020]+/g, '') and lowercases the value before testing the scheme. Because the href check does neither, it is bypassed by three obfuscation classes, all confirmed firing on click against the shipped 4.12.30 build: Case variants: JAVASCRIPT:, Javascript:, jaVaScRiPt: (the check is …
A <script> element placed directly inside an <svg> (or MathML) container was not removed by Jodit's clean-html sanitizer. The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names — an SVG script reports "script", not "SCRIPT" — so the default denyTags list (which includes script) did not match it. The script therefore survived in the editor value and serialized output, …
jodit's built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value. When an application supplies attacker-influenced HTML to the editor's value-set or insertion paths, the sanitized output still contains a live <img … onload=…> (or another non-onerror handler such as onfocus). A consumer that renders that output (element.innerHTML = editor.value) …
Jodit.modules.Helpers.set(chain, value, obj) walks the dot-separated chain, creating and following each path segment, without filtering prototype-mutating keys. A chain that begins with (or contains) proto, constructor, or prototype lets the final assignment reach and mutate Object.prototype (prototype pollution).
Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component.
Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.