GHSA-45QG-252V-3F7P
Vulnerability from github – Published: 2026-07-31 19:15 – Updated: 2026-07-31 19:15A <script> element placed directly inside an <svg> (or MathML) container was not removed by Jodit's clean-html sanitizer.
The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names — an SVG script reports "script", not "SCRIPT" — so the default denyTags list (which includes script) did not match it. The script therefore survived in the editor value and serialized output, where it could execute when the content was loaded back into a page or editor.
Proof of concept
<svg xmlns="http://www.w3.org/2000/svg" width="400" height="400" viewBox="0 0 124 124">
<rect width="124" height="124" rx="24" fill="#000000"></rect>
<script type="text/javascript">alert(document.domain);</script>
</svg>
Load the payload into the editor (e.g. via source mode) and the <script> is preserved in editor.value and executes.
Impact
Stored / DOM cross-site scripting. An application that persists editor output and later renders or re-opens it in Jodit can have attacker-supplied script run in a victim's (e.g. an administrator's) authenticated browser context.
Patch
Fixed in 4.13.6: the deny/allow lookup now normalises the tag name to upper case before matching, so a foreign namespace can no longer bypass the filter, while allowTags is still honoured.
Workaround
Upgrade to 4.13.6 or later. Server-side sanitization of stored HTML mitigates in the interim.
Credit
Reported by Roman Kis (@CrownKingClown).
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "jodit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.13.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-65841"
],
"database_specific": {
"cwe_ids": [
"CWE-80"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-31T19:15:57Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "A `\u003cscript\u003e` element placed directly inside an `\u003csvg\u003e` (or MathML) container was not removed by Jodit\u0027s clean-html sanitizer.\n\nThe deny/allow tag filter compared `node.nodeName` against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names \u2014 an SVG script reports `\"script\"`, not `\"SCRIPT\"` \u2014 so the default `denyTags` list (which includes `script`) did not match it. The script therefore survived in the editor value and serialized output, where it could execute when the content was loaded back into a page or editor.\n\n### Proof of concept\n\n```html\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\" width=\"400\" height=\"400\" viewBox=\"0 0 124 124\"\u003e\n \u003crect width=\"124\" height=\"124\" rx=\"24\" fill=\"#000000\"\u003e\u003c/rect\u003e\n \u003cscript type=\"text/javascript\"\u003ealert(document.domain);\u003c/script\u003e\n\u003c/svg\u003e\n```\n\nLoad the payload into the editor (e.g. via source mode) and the `\u003cscript\u003e` is preserved in `editor.value` and executes.\n\n### Impact\n\nStored / DOM cross-site scripting. An application that persists editor output and later renders or re-opens it in Jodit can have attacker-supplied script run in a victim\u0027s (e.g. an administrator\u0027s) authenticated browser context.\n\n### Patch\n\nFixed in **4.13.6**: the deny/allow lookup now normalises the tag name to upper case before matching, so a foreign namespace can no longer bypass the filter, while `allowTags` is still honoured.\n\n### Workaround\n\nUpgrade to 4.13.6 or later. Server-side sanitization of stored HTML mitigates in the interim.\n\n### Credit\n\nReported by Roman Kis (@CrownKingClown).",
"id": "GHSA-45qg-252v-3f7p",
"modified": "2026-07-31T19:15:57Z",
"published": "2026-07-31T19:15:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p"
},
{
"type": "WEB",
"url": "https://github.com/xdan/jodit/commit/49a31f451f6b686f5610022a1d4406ee85138dc5"
},
{
"type": "PACKAGE",
"url": "https://github.com/xdan/jodit"
},
{
"type": "WEB",
"url": "https://github.com/xdan/jodit/releases/tag/4.13.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Jodit has cross-site scripting (XSS) via \u003cscript\u003e nested in SVG that bypasses clean-html sanitization"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.