CVE-2026-65841
Received Received - Intake

XSS via Unsanitized SVG/MathML Script in Jodit Editor

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-08-01
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-65841
EUVD
EUVD-2026-51622

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jodit editor to 4.13.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Jodit Editor is a WYSIWYG editor with a built-in file browser and image editor. Prior to version 4.13.6, its clean-html denyTags filter fails to normalize foreign SVG or MathML script node names. This allows a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded.

Detection Guidance

Check the installed version of Jodit Editor. If it is below 4.13.6, the system is vulnerable. Inspect HTML content for unfiltered SVG or MathML script tags that could execute malicious code.

Impact Analysis

An attacker could inject malicious scripts via SVG or MathML content in the editor. When loaded, these scripts could execute arbitrary code in the user's browser, potentially leading to data theft, session hijacking, or other malicious activities.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance violations and legal consequences.

Mitigation Strategies

Upgrade Jodit Editor to version 4.13.6 or later. Review and sanitize any user-generated HTML content to remove untrusted SVG or MathML script elements before rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65841. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart