Description
A <script> element placed directly inside an <svg> (or MathML) container was not removed by Jodit’s clean-html sanitizer.
The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names — an SVG script reports "script", not "SCRIPT" — so the default denyTags list (which includes script) did not match it.
Recommendation
Update the jodit package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.13.6
- Patched version(s): 4.13.6
References
Could your website be exposed too?
SmartScanner can check your website for Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - CVE-2026-47760
- CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - CVE-2026-28343
- beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS) - CVE-2026-26226
- CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - @ckeditor/ckeditor5-html-support - CVE-2026-28343
You might also like:
See something that needs correcting? Let us knowUpdated July 31, 2026