Description
Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype (prototype pollution).
Recommendation
Update the jodit package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.12.18
- Patched version(s): 4.12.18
References
Could your website be exposed too?
SmartScanner can check your website for Jodit has prototype pollution via Jodit.configure() / ConfigMerge and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
- @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging - CVE-2026-54737
- @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
You might also like:
See something that needs correcting? Let us knowUpdated July 31, 2026