Description
jodit’s sanitizeHTMLElement neutralizes a javascript: href using a bare href.trim().indexOf('javascript') === 0 check. This omits the normalization jodit applies to every other URL attribute: isDangerousUrl strips control bytes with value.replace(/[\u0000-\u0020]+/g, '') and lowercases the value before testing the scheme.
Recommendation
Update the jodit package to the latest compatible version. Followings are version details:
- Affected version(s): <= 4.12.30
- Patched version(s): 4.12.31
References
Could your website be exposed too?
SmartScanner can check your website for Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos - CVE-2026-53606
- Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
- Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click - CVE-2026-43941
- CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS - CVE-2026-26028
You might also like:
See something that needs correcting? Let us knowUpdated July 31, 2026