jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set()

Description

Jodit.modules.Helpers.set(chain, value, obj) walks the dot-separated chain, creating and following each path segment, without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype (prototype pollution).

Recommendation

Update the jodit package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.12.26
• Patched version(s): 4.12.26

References

• GHSA-vpmm-x3fm-qr5c
• CVE-2026-55886
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() - CVE-2026-27837
• Jodit has prototype pollution via Jodit.configure() / ConfigMerge - CVE-2026-54756
• LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190
• @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

jodit