Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Description

A <script> element placed directly inside an <svg> (or MathML) container was not removed by Jodit’s clean-html sanitizer.

The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names — an SVG script reports "script", not "SCRIPT" — so the default denyTags list (which includes script) did not match it.

Recommendation

Update the jodit package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.13.6
• Patched version(s): 4.13.6

References

• GHSA-45qg-252v-3f7p
• CVE-2026-65841
• CWE-80
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - CVE-2026-47760
• CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - CVE-2026-28343
• beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS) - CVE-2026-26226
• CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - @ckeditor/ckeditor5-html-support - CVE-2026-28343

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

jodit