CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
An attacker can execute arbitrary JavaScript by injecting script tags within SVG or MathML elements that bypass the editor's HTML sanitization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-65841?
CVE-2026-65841 is a medium-severity cross-site scripting vulnerability in xdan jodit, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.
Weakness: CWE-80
Which versions are affected by CVE-2026-65841?
2 open source packages ship an affected version, including jodit.
| Package | Affected | Fixed in |
|---|---|---|
jodit npm | All versions | 4.13.6 |
jodit npm | All versions | 4.13.6 |
How do I fix CVE-2026-65841?
Upgrade jodit to 4.13.6 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-65841 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65841 exists.
Sources
Also known as GHSA-45qg-252v-3f7p.