CVE-2026-62324 Details
Description
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.
A cross-site scripting (XSS) vulnerability has been identified in Jodit Editor versions prior to 4.12.31. The issue arises in the 'sanitizeHTMLElement' method, which fails to properly sanitize 'javascript:' href values. This oversight allows case variations, control-byte prefixes, and embedded tabs or newlines to bypass the editor's filtering. As a result, attacker-controlled scripts can be executed when a user clicks on a stored link rendered by the application.
Users can update to Jodit Editor version 4.12.31 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 31, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/xdan/jodit/commit/5fba6ef2381d151d7cb8e3c5ad0b9996af0f97b0 | [email protected] | Source CodeVendor |
| https://github.com/xdan/jodit/releases/tag/4.12.31 | [email protected] | Release NotesVendor |
| https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-83 | Improper Neutralization of Script in Attributes in a Web Page | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Jodit Editor | <= 4.12.30 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Jul 31, 2026 | New CVE Received | [email protected] |