CVE-2026-65841CWE-80

CVE-2026-65841

published August 1, 2026

CVSS
5.3
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00529 · 44.0th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-08-01T00:16Z
References (4)
https://github.com/xdan/jodit/commit/49a31f451f6b686f5610022a1d4406ee85138dc5 · [email protected]https://github.com/xdan/jodit/releases/tag/4.13.6 · [email protected]https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p · [email protected]https://github.com/xdan/jodit/security/advisories/GHSA-45qg-252v-3f7p · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 31 JUL 19:16Z
    Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
    cvelistv5