CVE-2026-55886 Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()
Prototype pollution in Jodit Editor allows attackers to inject properties into Object.prototype, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55886?
CVE-2026-55886 is a medium-severity vulnerability in xdan jodit, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. Versions prior to 4.12.26 are vulnerable to Prototype Pollution through Jodit.modules.Helpers.set(chain, value, obj), which walks the dot-separated chain, creating and following each path segment without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype. Applications that pass a user-controlled or partially user-controlled key path into Jodit.modules.Helpers.set() could be vulnerable, causing unexpected property injection, logic bypass, denial of service, or secondary security issues. This issue has been fixed in version 4.12.26.
Weakness: CWE-1321
Which versions are affected by CVE-2026-55886?
2 open source packages ship an affected version, including jodit.
| Package | Affected | Fixed in |
|---|---|---|
jodit npm | All versions | 4.12.26 |
jodit npm | All versions | 4.12.26 |
How do I fix CVE-2026-55886?
Upgrade jodit to 4.12.26 or later.
Is CVE-2026-55886 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55886 exists.
Sources
Also known as GHSA-vpmm-x3fm-qr5c.