GHSA-45qg-252v-3f7p

Source

https://github.com/advisories/GHSA-45qg-252v-3f7p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-45qg-252v-3f7p/GHSA-45qg-252v-3f7p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-45qg-252v-3f7p

Aliases

CVE-2026-65841

Published

2026-07-31T19:15:57Z

Modified

2026-07-31T19:30:46.212538102Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Details

A <script> element placed directly inside an <svg> (or MathML) container was not removed by Jodit's clean-html sanitizer.

The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names — an SVG script reports "script", not "SCRIPT" — so the default denyTags list (which includes script) did not match it. The script therefore survived in the editor value and serialized output, where it could execute when the content was loaded back into a page or editor.

Proof of concept

<svg xmlns="http://www.w3.org/2000/svg" width="400" height="400" viewBox="0 0 124 124">
  <rect width="124" height="124" rx="24" fill="#000000"></rect>
  <script type="text/javascript">alert(document.domain);</script>
</svg>

Load the payload into the editor (e.g. via source mode) and the <script> is preserved in editor.value and executes.

Impact

Stored / DOM cross-site scripting. An application that persists editor output and later renders or re-opens it in Jodit can have attacker-supplied script run in a victim's (e.g. an administrator's) authenticated browser context.

Patch

Fixed in 4.13.6: the deny/allow lookup now normalises the tag name to upper case before matching, so a foreign namespace can no longer bypass the filter, while allowTags is still honoured.

Workaround

Upgrade to 4.13.6 or later. Server-side sanitization of stored HTML mitigates in the interim.

Credit

Reported by Roman Kis (@CrownKingClown).

Database specific

{
    "nvd_published_at": null,
    "github_reviewed_at": "2026-07-31T19:15:57Z",
    "cwe_ids": [
        "CWE-80"
    ],
    "github_reviewed": true,
    "severity": "MODERATE"
}

References

Affected packages

npm / jodit

Package

Name: jodit; View open source insights on deps.dev
Purl: pkg:npm/jodit

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.13.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-45qg-252v-3f7p/GHSA-45qg-252v-3f7p.json"