Description
Jodit.modules.Helpers.set(chain, value, obj) walks the dot-separated chain, creating and following each path segment, without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype (prototype pollution).
Recommendation
Update the jodit package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.12.26
- Patched version(s): 4.12.26
References
Could your website be exposed too?
SmartScanner can check your website for jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set() and gives you actionable findings to investigate.
Start a free scanRelated Issues
- dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() - CVE-2026-27837
- Jodit has prototype pollution via Jodit.configure() / ConfigMerge - CVE-2026-54756
- LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190
- @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
You might also like:
See something that needs correcting? Let us knowUpdated July 31, 2026