CVE-2026-55886

Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. Versions prior to 4.12.26 are vulnerable to Prototype Pollution through Jodit.modules.Helpers.set(chain, value, obj), which walks the dot-separated chain, creating and following each path segment without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype. Applications that pass a user-controlled or partially user-controlled key path into Jodit.modules.Helpers.set() could be vulnerable, causing unexpected property injection, logic bypass, denial of service, or secondary security issues. This issue has been fixed in version 4.12.26.

CVSS

No CVSS.

References

Link	Resource
https://github.com/xdan/jodit/security/advisories/GHSA-vpmm-x3fm-qr5c
https://github.com/xdan/jodit/security/advisories/GHSA-vpmm-x3fm-qr5c

Configurations

No configuration.

History

25 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Jodit Editor es un editor WYSIWYG escrito en TypeScript puro con capacidades de edición de archivos e imágenes. Las versiones anteriores a la 4.12.26 son vulnerables a la Contaminación de Prototipos a través de Jodit.modules.Helpers.set(chain, value, obj), que recorre la cadena separada por puntos, creando y siguiendo cada segmento de ruta sin filtrar claves que mutan el prototipo. Una cadena que comienza con (o contiene) __proto__, constructor o prototype permite que la asignación final alcance y mute Object.prototype. Las aplicaciones que pasan una ruta de clave controlada por el usuario o parcialmente controlada por el usuario a Jodit.modules.Helpers.set() podrían ser vulnerables, causando inyección de propiedades inesperada, omisión de lógica, denegación de servicio o problemas de seguridad secundarios. Este problema ha sido corregido en la versión 4.12.26.

Information

Published : 2026-07-01 21:17

Updated : 2026-10-25 16:10

NVD link : CVE-2026-55886

Mitre link : CVE-2026-55886

CVE.ORG link : CVE-2026-55886

JSON object : View

Products Affected

No product.

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2026-55886", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55886", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-02T12:22:09.347068Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "xdan", "product": "jodit", "versions": [{"status": "affected", "version": "< 4.12.26"}]}]}], "published": "2026-07-01T21:17:04.220", "references": [{"url": "https://github.com/xdan/jodit/security/advisories/GHSA-vpmm-x3fm-qr5c", "source": "security-advisories@github.com"}, {"url": "https://github.com/xdan/jodit/security/advisories/GHSA-vpmm-x3fm-qr5c", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. Versions prior to 4.12.26 are vulnerable to Prototype Pollution through Jodit.modules.Helpers.set(chain, value, obj), which walks the dot-separated chain, creating and following each path segment without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype. Applications that pass a user-controlled or partially user-controlled key path into Jodit.modules.Helpers.set() could be vulnerable, causing unexpected property injection, logic bypass, denial of service, or secondary security issues. This issue has been fixed in version 4.12.26."}, {"lang": "es", "value": "Jodit Editor es un editor WYSIWYG escrito en TypeScript puro con capacidades de edici\u00f3n de archivos e im\u00e1genes. Las versiones anteriores a la 4.12.26 son vulnerables a la Contaminaci\u00f3n de Prototipos a trav\u00e9s de Jodit.modules.Helpers.set(chain, value, obj), que recorre la cadena separada por puntos, creando y siguiendo cada segmento de ruta sin filtrar claves que mutan el prototipo. Una cadena que comienza con (o contiene) __proto__, constructor o prototype permite que la asignaci\u00f3n final alcance y mute Object.prototype. Las aplicaciones que pasan una ruta de clave controlada por el usuario o parcialmente controlada por el usuario a Jodit.modules.Helpers.set() podr\u00edan ser vulnerables, causando inyecci\u00f3n de propiedades inesperada, omisi\u00f3n de l\u00f3gica, denegaci\u00f3n de servicio o problemas de seguridad secundarios. Este problema ha sido corregido en la versi\u00f3n 4.12.26."}], "lastModified": "2026-10-25T16:10:00.147", "sourceIdentifier": "security-advisories@github.com"}