Security: xdan/jodit
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Cross-site scripting (XSS) via <script> nested in SVG bypasses clean-html sanitizationGHSA-45qg-252v-3f7p published
Jul 22, 2026 by xdanModerate -
Incomplete javascript: scheme normalization in sanitizeHTMLElement href check allows link XSS in joditGHSA-j839-gqq4-gf9j published
Jun 26, 2026 by xdanModerate -
Mutation XSS in jodit clean-html via a MathML/style rawtext carrierGHSA-rxcw-mc6f-6hr3 published
Jun 22, 2026 by xdanHigh -
Prototype pollution in Jodit via Jodit.modules.Helpers.set()GHSA-vpmm-x3fm-qr5c published
Jun 16, 2026 by xdanModerate -
Prototype pollution in Jodit via Jodit.configure() / ConfigMergeGHSA-5957-5c94-3v7w published
Jun 9, 2026 by xdanModerate