npm/jodit

Jodit Editor vulnerable to Cross-site Scripting

Modified: 11/8/2023

Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Modified: 7/31/2026

Jodit has prototype pollution via Jodit.configure() / ConfigMerge

Modified: 7/31/2026

Jodit Editor vulnerable to cross-site scripting

Modified: 11/8/2023

Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Modified: 7/31/2026

Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

Modified: 7/31/2026

jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set()

Modified: 7/31/2026