CVE-2026-65841

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.

CVSS

No CVSS.

References

Link	Resource
https://github.com/xdan/jodit/commit/49a31f451f6b686f5610022a1d4406ee85138dc5
https://github.com/xdan/jodit/releases/tag/4.13.6
https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p
https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Jodit Editor es un editor WYSIWYG con un navegador de archivos y editor de imágenes incorporado. Antes de la versión 4.13.6, el filtro clean-html denyTags de Jodit no normaliza los nombres de nodos de script SVG o MathML externos, permitiendo que un elemento script anidado directamente en SVG o MathML permanezca en editor.value y se ejecute cuando se carga el contenido. Este problema está solucionado en la versión 4.13.6.

Information

Published : 2026-07-31 20:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-65841

Mitre link : CVE-2026-65841

CVE.ORG link : CVE-2026-65841

JSON object : View

Products Affected

No product.

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2026-65841", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65841", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T20:05:04.456041Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "xdan", "product": "jodit", "versions": [{"status": "affected", "version": "< 4.13.6"}]}]}], "published": "2026-07-31T20:16:53.967", "references": [{"url": "https://github.com/xdan/jodit/commit/49a31f451f6b686f5610022a1d4406ee85138dc5", "source": "security-advisories@github.com"}, {"url": "https://github.com/xdan/jodit/releases/tag/4.13.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p", "source": "security-advisories@github.com"}, {"url": "https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6."}, {"lang": "es", "value": "Jodit Editor es un editor WYSIWYG con un navegador de archivos y editor de im\u00e1genes incorporado. Antes de la versi\u00f3n 4.13.6, el filtro clean-html denyTags de Jodit no normaliza los nombres de nodos de script SVG o MathML externos, permitiendo que un elemento script anidado directamente en SVG o MathML permanezca en editor.value y se ejecute cuando se carga el contenido. Este problema est\u00e1 solucionado en la versi\u00f3n 4.13.6."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security-advisories@github.com"}