{"action":"Upgrade jodit to 4.13.6 or later.","affected":[{"fixed":"4.13.6","introduced":"0"}],"component":"jodit","cve_ids":["CVE-2026-65841"],"ecosystem":"npm","epss":0.00529,"exploited":false,"fixed_versions":["4.13.6"],"ghsa_id":"GHSA-45qg-252v-3f7p","id":"tcs_01M5KEZE11Z3KJX0WHDJNVVAYV","modified_at":"2026-07-31T19:41:43.225459Z","published_at":"2026-07-31T19:15:57Z","references":["https://osv.dev/vulnerability/GHSA-45qg-252v-3f7p","https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p","https://github.com/xdan/jodit/commit/49a31f451f6b686f5610022a1d4406ee85138dc5","https://github.com/xdan/jodit","https://github.com/xdan/jodit/releases/tag/4.13.6"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-45qg-252v-3f7p","url":"https://osv.dev/vulnerability/GHSA-45qg-252v-3f7p"},{"source":"nvd","source_id":"CVE-2026-65841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65841"}],"summary":"Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization"}