CVE-2026-54756

Received Received - Intake

Prototype Pollution in Jodit Editor

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: GitHub, Inc.

Description

Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.18, Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys, potentially causing a Prototype Pollution vulnerability. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype. Applications that pass user-controlled or partially user-controlled configuration into Jodit.configure() may be vulnerable. This issue was fixed in version 4.12.18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-01

Generated

2026-07-02

AI Q&A

2026-07-02

EPSS Evaluated

N/A

NVD

CVE-2026-54756

Affected Vendors & Products

Vendor	Product	Version / Range
jodit	editor	to 4.12.18 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Mitigation Strategies

To mitigate this vulnerability, update Jodit Editor to version 4.12.18 or later, where the issue has been fixed.

Avoid passing user-controlled or partially user-controlled configuration objects into Jodit.configure() until the update is applied.

Executive Summary

The vulnerability in Jodit Editor versions prior to 4.12.18 involves Prototype Pollution. Specifically, the function Jodit.configure(options) and its internal helpers merged user-supplied options into the editor configuration without filtering out keys that can mutate the prototype. This means that a malicious payload nested under an existing plain-object option, such as controls, could reach and modify Object.prototype, potentially altering the behavior of all objects.

Impact Analysis

This Prototype Pollution vulnerability can allow an attacker to manipulate the prototype of base objects, which may lead to unexpected behavior in the application. This can result in security issues such as privilege escalation, denial of service, or arbitrary code execution depending on how the application uses the affected objects. Applications that accept user-controlled or partially user-controlled configuration data into Jodit.configure() are particularly at risk.

Hi! I’m here to help you understand CVE-2026-54756. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70