CVE-2026-62324CWE-79CWE-83cross-site-scripting

CVE-2026-62324

Medium · published August 1, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00313 · 23.0th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-83 · Improper Neutralization of Script in Attributes in a Web Page
Published
2026-08-01T00:16Z
References (4)
https://github.com/xdan/jodit/commit/5fba6ef2381d151d7cb8e3c5ad0b9996af0f97b0 · [email protected]https://github.com/xdan/jodit/releases/tag/4.12.31 · [email protected]https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j · [email protected]https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 31 JUL 19:08Z
    Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
    cvelistv5