Vulnerability Description
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/xdan/jodit/commit/5fba6ef2381d151d7cb8e3c5ad0b9996af0f97b0
- https://github.com/xdan/jodit/releases/tag/4.12.31
- https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j
- https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j
FAQ
What is CVE-2026-62324?
CVE-2026-62324 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values befo...
How severe is CVE-2026-62324?
CVE-2026-62324 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-62324?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.