GHSA-5957-5c94-3v7w
Suggest an improvement- Source
- https://github.com/advisories/GHSA-5957-5c94-3v7w
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5957-5c94-3v7w/GHSA-5957-5c94-3v7w.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-5957-5c94-3v7w
- Aliases
- Published
- 2026-07-31T19:10:16Z
- Modified
- 2026-07-31T19:15:24Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Jodit has prototype pollution via Jodit.configure() / ConfigMerge
- Details
-
Summary
Jodit.configure(options)— and the internalConfigMerge/ConfigProtohelpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such ascontrolscould reach and mutateObject.prototype(prototype pollution).Affected
- Package:
jodit(npm) - Versions:
< 4.12.18 - Public API:
Jodit.configure(options)
Proof of Concept
import { Jodit } from 'jodit'; delete Object.prototype.polluted; Jodit.configure(JSON.parse('{"controls":{"__proto__":{"polluted":"yes"}}}')); console.log(({}).polluted); // "yes" (before the fix) delete Object.prototype.polluted;Impact
Applications that pass user-controlled or partially user-controlled configuration into
Jodit.configure()could be vulnerable to prototype pollution: unexpected property injection, logic bypass, denial of service, or secondary security issues.Patch
Fixed in 4.12.18 by rejecting
__proto__,constructor, andprototypeat every merge level inConfigMergeandConfigProto.Credit
Responsibly reported by Junming Wu.
- Package:
- Database specific
{ "cwe_ids": [ "CWE-1321" ], "github_reviewed": true, "github_reviewed_at": "2026-07-31T19:10:16Z", "nvd_published_at": "2026-07-01T21:17:03Z", "severity": "MODERATE" }- References
Affected packages
npm / jodit
Package
- Name
- jodit
- View open source insights on deps.dev
- Purl
- pkg:npm/jodit