CVE-2026-58263: CVE-2026-58263: Mutation Cross-Site Scripting (mXSS) in Jodit Editor clean-html Sanitizer

#security #cve #cybersecurity

CVE-2026-58263: Mutation Cross-Site Scripting (mXSS) in Jodit Editor clean-html Sanitizer

Vulnerability ID: CVE-2026-58263
CVSS Score: 7.2
Published: 2026-07-31

CVE-2026-58263 is a high-severity Mutation Cross-Site Scripting (mXSS) vulnerability affecting Jodit Editor prior to version 4.12.28. The flaw exists in Jodit's built-in clean-html sanitizer plugin, which fails to securely parse and sanitize nested elements containing foreign namespaces like MathML and SVG. Attackers can bypass sanitization by smuggling malicious payload elements inside rawtext container tags like style inside a MathML node, leading to DOM mutation and unauthenticated arbitrary script execution in the context of the user's browser session.

TL;DR

Unauthenticated remote mutation cross-site scripting (mXSS) in Jodit Editor < 4.12.28 allows attackers to bypass HTML sanitization and execute arbitrary JavaScript by leveraging parser differentials between the inert sanitization sandbox and the live editor DOM.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-79
Attack Vector: Network (Unauthenticated)
CVSS v3.1: 7.2 (High)
EPSS Score: 0.00179
Impact: Mutation XSS (Client-Side Code Execution)
Exploit Status: PoC (In Unit Tests)
CISA KEV Status: Not Listed

Affected Systems

Jodit Editor client-side application
Jodit Editor: < 4.12.28 (Fixed in: 4.12.28)

Code Analysis

Commit: 0ebb616

Fix mXSS in clean-html by identifying and stripping elements smuggled in foreign content.

const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
const HTML_INTEGRATION_POINTS = new Set([
    'foreignobject',
    'annotation-xml',
    'desc',
    'title'
]);
function isSmuggledForeignHtml(elm: Element): boolean {
    if (elm.namespaceURI !== HTML_NAMESPACE || elm.closest('math,svg') === null) {
        return false;
    }
    for (let parent = elm.parentElement; parent; parent = parent.parentElement) {
        const name = parent.nodeName.toLowerCase();
        if (name === 'math' || name === 'svg') {
            break;
        }
        if (HTML_INTEGRATION_POINTS.has(name)) {
            return false;
        }
    }
    return true;
}

Exploit Details

GitHub Unit Tests: Proof of concept payload integrated directly into the test suite of Jodit Editor.

Mitigation Strategies

Upgrade Jodit Editor to version 4.12.28 or later.
Implement robust server-side HTML sanitization using library like DOMPurify or specialized backend sanitizers.
Enforce a strict Content Security Policy (CSP) with restricted script-src policies.

Remediation Steps:

Identify all application deployments utilizing the Jodit WYSIWYG editor.
Update the npm or CDN dependency of Jodit to version 4.12.28.
Validate the client-side configuration to ensure default HTML cleaning is enabled.
Deploy secondary server-side output validation to sanitize rich text submissions.

References

Read the full report for CVE-2026-58263 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community