Jodit security advisories
Every vulnerability reported in the Jodit editor or the jodit-nodejs connector is fixed in a release, published as a GitHub advisory with a CVE, and listed here with the version that closes it. Keep the editor on the latest release (4.18.2 or newer) and every entry on this page is behind you.
How to report
Write to [email protected] or open a private report on GitHub. Include the version, a proof of concept and the impact. Please keep the issue private until the fix is released.
What happens next
We confirm the report, reproduce it, ship the fix in a patch release of the free editor and the PRO build, publish the advisory with a CVE and credit the reporter. Recent reports were fixed within days.
Defence in depth
The editor sanitises HTML on every way in: paste, drag-and-drop, value assignment and the initial content. Its sanitiser is covered by a regression suite that pins every published payload. The hardening guide covers CSP, Trusted Types and server-side sanitisation.
Published advisories
All advisories for the jodit npm package and the jodit-nodejs connector. The same list is on GitHub Advisory Database, which is what npm audit reads: a current release audits clean.
| Advisory | Issue | Severity | Affected | Fixed in | Published |
|---|---|---|---|---|---|
| GHSA-7pxg-rf9q-fg33 jodit | Stored XSS: event handlers in a textarea initial value ran before clean-html sanitised it | High | >= 3.8.3, < 4.18.2 | 4.18.2 | 2026-10-16 |
| GHSA-gr86-hxq8-g84q jodit | Mutation XSS on value assignment through a <noscript> carrier | Critical | <= 4.17.2 | 4.17.3 | 2026-10-08 |
| GHSA-jhhp-r3r7-v2cg jodit | Stored XSS: event handler attributes survived the background clean-html pass on drag-and-drop | Medium | <= 4.17.0 | 4.17.1 | 2026-09-30 |
| GHSA-w3xv-x3fm-59ph jodit | Stored XSS when loading full HTML documents in editHTMLDocumentMode | High | <= 4.14.5 | 4.14.6 | 2026-09-08 |
| CVE-2026-65841 GHSA-45qg-252v-3f7p jodit | XSS via <script> nested in SVG bypassed clean-html sanitisation | Medium | < 4.13.6 | 4.13.6 | 2026-07-22 |
| CVE-2026-62324 GHSA-j839-gqq4-gf9j jodit | Incomplete javascript: scheme normalisation in the href check allowed link XSS | Medium | <= 4.12.30 | 4.12.31 | 2026-06-26 |
| CVE-2026-58263 GHSA-rxcw-mc6f-6hr3 jodit | Mutation XSS in clean-html via a MathML/style rawtext carrier | High | < 4.12.28 | 4.12.28 | 2026-06-22 |
| CVE-2026-55886 GHSA-vpmm-x3fm-qr5c jodit | Prototype pollution via Jodit.modules.Helpers.set() | Medium | < 4.12.26 | 4.12.26 | 2026-06-16 |
| CVE-2026-54756 GHSA-5957-5c94-3v7w jodit | Prototype pollution via Jodit.configure() / ConfigMerge | Medium | < 4.12.18 | 4.12.18 | 2026-06-09 |
| CVE-2023-42399 GHSA-95xr-cq6h-vwr3 jodit | XSS through <iframe src="JavaScript:..."> in the rich text editor Reported against a 4.0 beta. The sanitiser rewrite in 4.11.2 strips the src entirely; the exact payload is pinned in the regression suite. | Medium | 4.0.0-beta.86 (the javascript: iframe src was kept up to 4.10.3) | 4.11.2 | 2023-09-19 |
| CVE-2022-23461 GHSA-42hx-vrxx-5r6v jodit | XSS when pasting specially constructed input (GHSL-2022-030) The advisory text still says "not fully patched" from 2022. The pasted-from-Word proof of concept stops executing in 3.18.2; Jodit 4 rewrote the sanitiser and 4.12.31 closed the remaining javascript: scheme normalisation gap (CVE-2026-62324). | Medium | <= 3.17.1 (published proof of concept); 3.x | 3.18.2 for the published proof of concept; 4.12.31 for the whole javascript: URL class | 2022-09-25 |
| GHSA-9fcr-7f44-wg4m jodit-nodejs | A refused upload deleted an existing file, access rules could be bypassed by path spelling, folderRemove could delete the current folder | High | < 2.0.0 | 2.0.0 | 2026-10-05 |
| GHSA-q4mv-xgj5-xq6r jodit-nodejs | Stored XSS through uploaded SVG, HTML and JavaScript files | High | < 2.0.0 | 2.0.0 | 2026-10-05 |
| GHSA-6m9h-cm53-f92r jodit-nodejs | Server-side request forgery in the PDF and DOCX renderers and in the remote-upload guard | High | < 2.0.0 | 2.0.0 | 2026-10-05 |
Entries in third-party scanners
Some vulnerability databases copied old advisories with an open-ended version range, so a dependency scan can flag a current release that is not affected. If your security review hits one of these, this is the status.
- SNYK-JS-JODIT-3032996
Snyk lists CVE-2022-23461 with the range "*" and "no fixed version". The GitHub advisory it mirrors limits it to <= 3.24.2; the published proof of concept does not execute from 3.18.2, and the javascript: URL class it belongs to was closed for good in 4.12.31. Every 4.x release is unaffected. We have asked Snyk to narrow the range.
- SNYK-JS-JODIT-5905474
Snyk lists CVE-2023-42399 with the range "*" and "no fixed version". The CVE names a single 4.0 beta; the payload is stripped since 4.11.2 and is part of the regression suite. We have asked Snyk to set the fixed version.
Need this for a security review?
Enterprise customers get a signed security statement, answers to vendor questionnaires and a direct line to the developers.
Jodit Enterprise