CVE-2026-58263 Details
Description
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value, potentially causing Mutation XSS. When an application supplies attacker-influenced HTML to the editor's value-set or insertion paths, the sanitized output still contains a live <img ... onload=...> (or another non-onerror handler such as onfocus). A consumer that renders that output (element.innerHTML = editor.value) executes the handler with no user interaction. This issue has been fixed in version 4.12.28.
A stored cross-site scripting vulnerability has been identified in Jodit Editor versions prior to 4.12.28. The issue arises in the built-in 'clean-html' sanitizer, which can be bypassed using a MathML or '<style>' carrier that conceals a harmful element from the sanitizer's processing. As a result, a no-interaction event handler can be preserved in the editor's value, potentially leading to mutation-based cross-site scripting. When an application injects attacker-controlled HTML into the editor, the sanitized output may still include a live '<img>' tag with an 'onload' attribute (or another non-'onerror' event handler), executing the handler automatically without user interaction. This vulnerability has been confirmed in Jodit Editor versions 4.12.25 and 4.12.27, where the 'onload' event handler was triggered via a client-side 'innerHTML' operation in Chromium, and through server-rendered output in Firefox.
Users should update Jodit Editor to version 4.12.28 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 1, 2026CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xdan/jodit/security/advisories/GHSA-rxcw-mc6f-6hr3 | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/xdan/jodit/security/advisories/GHSA-rxcw-mc6f-6hr3 | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-83 | Improper Neutralization of Script in Attributes in a Web Page | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Jodit Editor | < 4.12.28 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | [email protected] |
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |