p PatchFirst

CVE-2026-65841

CVE-2026-65841 · Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.

CVSS 5.3 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • jodit

    Versions
    • < 4.13.6: Affected

    No fix published

  • jodit npm

    Affected ranges
    • SEMVER: < 4.13.6

    Update to 4.13.6

Original sources

Check your server →