DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-65841: CVE-2026-65841: Client-Side Cross-Site Scripting (XSS) via Foreign Namespace Sanitization Bypass in Jodit Editor

#security #cve #cybersecurity

CVE-2026-65841: Client-Side Cross-Site Scripting (XSS) via Foreign Namespace Sanitization Bypass in Jodit Editor

Vulnerability ID: CVE-2026-65841
CVSS Score: 5.3
Published: 2026-07-31

Jodit Editor versions prior to 4.13.6 are vulnerable to client-side Cross-Site Scripting (XSS). The clean-html plugin's sanitization routine performs case-sensitive lookups against uppercase-only element blacklists. When processing XML-based foreign namespaces such as SVG or MathML, DOM engines preserve the lowercase format of tags. Because Jodit's denyTags check fails to normalize tag casing, malicious script blocks nested inside foreign namespace elements completely bypass validation and serialize directly into the editor output.

TL;DR

Jodit Editor versions prior to 4.13.6 fail to normalize tag names to uppercase during validation. Malicious script tags nested within SVG or MathML tags bypass the case-sensitive blacklist filter and execute arbitrary JavaScript.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-80 (Improper Neutralization of Script-Related HTML Tags)
  • Attack Vector: Network (AV:N)
  • CVSS Score: 5.3 (Medium)
  • EPSS Score: Not available
  • Impact: Client-Side Code Execution (XSS)
  • Exploit Status: Proof-of-Concept (PoC) documented in official test suites
  • KEV Status: Not listed in CISA KEV

Affected Systems

  • Applications utilizing Jodit Editor versions prior to 4.13.6 for formatting, rich-text output, or HTML serialization.
  • Jodit Editor: < 4.13.6 (Fixed in: 4.13.6)

Code Analysis

Commit: 49a31f4

Fix sanitization bypass in clean-html by converting nodeName to uppercase before allow/deny lookup checks.

Mitigation Strategies

  • Upgrade Jodit Editor dependency to version 4.13.6 or above.
  • Deploy a Content Security Policy (CSP) to mitigate arbitrary script execution.
  • Verify server-side HTML sanitization checks are in place prior to persistence layers.

Remediation Steps:

  1. Modify package.json to require jodit version ^4.13.6.
  2. Run npm update jodit or yarn upgrade jodit to apply the update.
  3. Confirm the file node_modules/jodit/src/plugins/clean-html/helpers/visitor/filters/try-remove-node.ts contains the .toUpperCase() call.
  4. Configure your web server or web application to emit a strict Content-Security-Policy header.

References

Read the full report for CVE-2026-65841 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)