What’s Vulnerable › Vulnerabilities

CVE-2026-62324: Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-31 · updated 2026-10-23
• Weakness: CWE-79

Description

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.

Affected products

• xdan jodit: before 4.12.31

References

• https://github.com/xdan/jodit/commit/5fba6ef2381d151d7cb8e3c5ad0b9996af0f97b0
• https://github.com/xdan/jodit/releases/tag/4.12.31
• https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j
• https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j

Get alerted when CVE-2026-62324 or the next vulnerability affects your stack