CVE-2026-54756

Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.18, Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys, potentially causing a Prototype Pollution vulnerability. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype. Applications that pass user-controlled or partially user-controlled configuration into Jodit.configure() may be vulnerable. This issue was fixed in version 4.12.18.

CVSS

No CVSS.

References

Link	Resource
https://github.com/xdan/jodit/security/advisories/GHSA-5957-5c94-3v7w
https://github.com/xdan/jodit/security/advisories/GHSA-5957-5c94-3v7w

Configurations

No configuration.

History

25 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Jodit Editor es un editor WYSIWYG escrito en TypeScript puro con capacidades de edición de archivos e imágenes. En versiones anteriores a la 4.12.18, Jodit.configure(options) - y los ayudantes internos ConfigMerge / ConfigProto - fusionaban opciones proporcionadas por el usuario en la configuración del editor sin filtrar claves que mutan el prototipo, lo que podría causar una vulnerabilidad de Prototype Pollution. Una carga útil anidada bajo una opción de objeto plano existente como controls podría alcanzar y mutar Object.prototype. Las aplicaciones que pasan configuración controlada por el usuario o parcialmente controlada por el usuario a Jodit.configure() pueden ser vulnerables. Este problema fue solucionado en la versión 4.12.18.

Information

Published : 2026-07-01 21:17

Updated : 2026-10-25 16:10

NVD link : CVE-2026-54756

Mitre link : CVE-2026-54756

CVE.ORG link : CVE-2026-54756

JSON object : View

Products Affected

No product.

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2026-54756", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54756", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-02T14:41:06.814851Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "xdan", "product": "jodit", "versions": [{"status": "affected", "version": "< 4.12.18"}]}]}], "published": "2026-07-01T21:17:03.553", "references": [{"url": "https://github.com/xdan/jodit/security/advisories/GHSA-5957-5c94-3v7w", "source": "security-advisories@github.com"}, {"url": "https://github.com/xdan/jodit/security/advisories/GHSA-5957-5c94-3v7w", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.18, Jodit.configure(options) \u2014 and the internal ConfigMerge / ConfigProto helpers \u2014 merged user-supplied options into the editor configuration without filtering prototype-mutating keys, potentially causing a Prototype Pollution vulnerability. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype. Applications that pass user-controlled or partially user-controlled configuration into Jodit.configure() may be vulnerable. This issue was fixed in version 4.12.18."}, {"lang": "es", "value": "Jodit Editor es un editor WYSIWYG escrito en TypeScript puro con capacidades de edici\u00f3n de archivos e im\u00e1genes. En versiones anteriores a la 4.12.18, Jodit.configure(options) - y los ayudantes internos ConfigMerge / ConfigProto - fusionaban opciones proporcionadas por el usuario en la configuraci\u00f3n del editor sin filtrar claves que mutan el prototipo, lo que podr\u00eda causar una vulnerabilidad de Prototype Pollution. Una carga \u00fatil anidada bajo una opci\u00f3n de objeto plano existente como controls podr\u00eda alcanzar y mutar Object.prototype. Las aplicaciones que pasan configuraci\u00f3n controlada por el usuario o parcialmente controlada por el usuario a Jodit.configure() pueden ser vulnerables. Este problema fue solucionado en la versi\u00f3n 4.12.18."}], "lastModified": "2026-10-25T16:10:00.147", "sourceIdentifier": "security-advisories@github.com"}