medium6.3
CVE-2026-54756
Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities.
Impact
Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.18, Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys, potentially causing a Prototype Pollution vulnerability. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype. Applications that pass user-controlled or partially user-controlled configuration into Jodit.configure() may be vulnerable. This issue was fixed in version 4.12.18.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | jodit | < 4.12.18 | 4.12.18 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-5957-5c94-3v7w
- https://github.com/xdan/jodit/security/advisories/GHSA-5957-5c94-3v7w
- https://nvd.nist.gov/vuln/detail/CVE-2026-54756
- https://github.com/xdan/jodit/commit/d298397bc993793b17145806c15f7dae53f90104
- https://github.com/xdan/jodit/releases/tag/4.12.18