Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

Description

jodit’s built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer’s element walk, so a no-interaction event handler survives into the editor value.

Recommendation

Update the jodit package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.12.28
• Patched version(s): 4.12.28

References

• GHSA-rxcw-mc6f-6hr3
• CVE-2026-58263
• CWE-79
• CWE-83
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
• Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - marko - CVE-2026-41591
• Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - CVE-2026-41591
• Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

jodit