CVE-2026-65841: 
JavaScript vulnerability analysis and mitigation

CVE-2026-65841 is a stored/DOM cross-site scripting (XSS) vulnerability in Jodit Editor, a WYSIWYG editor with a built-in file browser and image editor. The flaw exists in the clean-html plugin's denyTags filter, which fails to normalize foreign SVG or MathML script node names, allowing a <script> element nested inside <svg> or MathML to bypass sanitization and execute when content is loaded. All versions of the npm package jodit prior to 4.13.6 are affected. The vulnerability was reported by Roman Kis (@CrownKingClown), published to the GitHub Advisory Database on July 31, 2026, and carries a CVSS v4 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). Jodit's clean-html plugin maintains a denyTags hash keyed by upper-cased tag names (e.g., SCRIPT). However, DOM elements in foreign namespaces such as SVG and MathML preserve their original lowercase nodeName — an SVG <script> reports "script", not "SCRIPT" — causing the case-sensitive lookup to miss the match and leave the script node intact in editor.value. The fix in 4.13.6 normalizes node.nodeName to upper case via .toUpperCase() before performing the allow/deny lookup in src/plugins/clean-html/helpers/visitor/filters/try-remove-node.ts. A public proof-of-concept payload is included in the advisory: an SVG element containing a <script type="text/javascript">alert(document.domain);</script> child node (GitHub Advisory, Patch Commit).

Successful exploitation results in stored or DOM-based XSS. An attacker who can supply content to a Jodit editor instance (e.g., via source mode or an API) can embed a persistent malicious script that executes in the browser context of any user — including administrators — who subsequently loads or views the saved content. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and potential privilege escalation within the application (GitHub Advisory).

1. Identify a target: Find a web application that uses Jodit Editor (npm package jodit) in a version prior to 4.13.6 and allows users to submit or store rich HTML content.
2. Craft the payload: Construct an SVG-wrapped script payload that bypasses the denyTags filter:

<svg xmlns="http://www.w3.org/2000/svg" width="400" height="400" viewBox="0 0 124 124">
  <rect width="124" height="124" rx="24" fill="#000000"></rect>
  <script type="text/javascript">alert(document.domain);</script>
</svg>

3. Inject the payload: Load the payload into the editor via source/HTML mode or through a direct API call that sets editor.value. The clean-html sanitizer processes the content but fails to remove the SVG-namespaced <script> due to the case mismatch.
4. Persist the content: Submit or save the editor content. The malicious script survives in the stored HTML output because node.nodeName returns "script" (lowercase) while the denyTags hash key is "SCRIPT" (uppercase).
5. Trigger execution: When a victim (e.g., an administrator) loads or views the stored content — either in a page that renders the HTML or by reopening it in a Jodit editor — the SVG-embedded script executes in their authenticated browser context, enabling session hijacking, credential theft, or further exploitation (GitHub Advisory).

• Network: HTTP requests containing SVG payloads with embedded <script> tags in POST body parameters destined for content-saving endpoints; unusual outbound requests from victim browsers to attacker-controlled domains following content load.
• Logs: Application or web server logs showing submission of content containing <svg combined with <script strings in request bodies; repeated access to content-rendering pages by high-privilege accounts shortly after suspicious content submissions.
• File System / Database: Stored HTML content in the application database or file storage containing patterns such as <svg with a nested <script tag, particularly with type="text/javascript" attributes.
• Browser / Client-Side: Unexpected JavaScript execution (e.g., alert() dialogs, console errors, or network requests to unknown domains) when loading editor content; browser developer tools showing script execution originating from SVG elements in the DOM.

Upgrade the jodit npm package to version 4.13.6 or later, which normalizes node.nodeName to upper case before performing allow/deny tag lookups, closing the bypass. As an interim workaround, implement server-side HTML sanitization of all content stored from Jodit editor instances before persisting or rendering it, using a library that correctly handles foreign-namespace elements. There are no configuration-level workarounds within Jodit itself for versions prior to 4.13.6 (GitHub Advisory, Release 4.13.6).

The vulnerability was reported by security researcher Roman Kis (@CrownKingClown) and credited in the official advisory. The fix was released by the maintainer (xdan) on July 21, 2026, with the advisory published to the GitHub Advisory Database on July 31, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GitHub Advisory).