CVE-2026-65841
1 advisory.
npm/jodit CVE-2026-65841: medium, EPSS 0.53%
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
Action: Upgrade jodit to 4.13.6 or later.
npm i jodit@4.13.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.13.6 | - |
Fixed versions
| 4.13.6 |
Sources
- osv: GHSA-45qg-252v-3f7p
- https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p
- https://github.com/xdan/jodit/commit/49a31f451f6b686f5610022a1d4406ee85138dc5
- https://github.com/xdan/jodit
- https://github.com/xdan/jodit/releases/tag/4.13.6
CVE-2026-65841 · published · modified · JSON