Description
jodit’s built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer’s element walk, so a no-interaction event handler survives into the editor value.
Recommendation
Update the jodit package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.12.28
- Patched version(s): 4.12.28
References
Could your website be exposed too?
SmartScanner can check your website for Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
- Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - marko - CVE-2026-41591
- Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - CVE-2026-41591
- Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990
You might also like:
See something that needs correcting? Let us knowUpdated July 31, 2026