Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Description

jodit’s sanitizeHTMLElement neutralizes a javascript: href using a bare href.trim().indexOf('javascript') === 0 check. This omits the normalization jodit applies to every other URL attribute: isDangerousUrl strips control bytes with value.replace(/[\u0000-\u0020]+/g, '') and lowercases the value before testing the scheme.

Recommendation

Update the jodit package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.12.30
• Patched version(s): 4.12.31

References

• GHSA-j839-gqq4-gf9j
• CVE-2026-62324
• CWE-79
• CWE-83
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos - CVE-2026-53606
• Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
• Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click - CVE-2026-43941
• CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS - CVE-2026-26028

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

How do hackers hack websites?

Tags:

npm

jodit