github.com
https://github.com/xdan/jodit CVE-2026-65841
MEDIUM
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
Record summary
CVE-2026-65841 has a selected CVSS score of 5.3 (medium).
Description
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 31, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
joditBrowse xdan / jodit | CVE List | < 4.13.6 | affected |
joditBrowse npm / jodit | GitHub Advisory | Before 4.13.6 · Fixed in 4.13.6 | affected |
References
4github.com
https://github.com/xdan/jodit/commit/49a31f451f6b686f5610022a1d4406ee85138dc5 github.com
https://github.com/xdan/jodit/releases/tag/4.13.6 github.comConfirmation
https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p