{"id":"EUVD-2026-41139","enisaUuid":"94728f19-0b10-33c8-959d-7e97a39cce02","description":"Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.18, Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys, potentially causing a Prototype Pollution vulnerability. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype. Applications that pass user-controlled or partially user-controlled configuration into Jodit.configure() may be vulnerable. This issue was fixed in version 4.12.18.","datePublished":"Jul 1, 2026, 8:29:17 PM","dateUpdated":"Jul 2, 2026, 2:41:32 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/xdan/jodit/security/advisories/GHSA-5957-5c94-3v7w\n","aliases":"CVE-2026-54756\nGHSA-5957-5c94-3v7w\n","assigner":"GitHub_M","epss":0.46,"enisaIdProduct":[{"id":"a255f5df-95fb-38e4-83d4-2359429af2da","product":{"name":"jodit","vendor":{"name":"xdan"}},"product_version":"\u003c 4.12.18"}],"enisaIdVendor":[{"id":"8b68a9dc-60f2-3f30-aa23-c14af88c6d2e","vendor":{"name":"xdan"}}],"enisaIdVulnerability":[{"id":"67c7eaf4-47c7-3a27-bd5f-9651c7e54243","vulnerability":{"id":"CVE-2026-54756","description":"Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.18, Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys, potentially causing a Prototype Pollution vulnerability. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype. Applications that pass user-controlled or partially user-controlled configuration into Jodit.configure() may be vulnerable. This issue was fixed in version 4.12.18.","datePublished":"Jul 1, 2026, 8:29:17 PM","dateUpdated":"Jul 2, 2026, 2:41:32 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/xdan/jodit/security/advisories/GHSA-5957-5c94-3v7w\n","enisa_id":"EUVD-2026-41139\n","assigner":"GitHub_M","epss":0.46,"dataProcessed":"Nov 7, 2026, 7:20:15 AM","vulnerabilityProduct":[{"id":"ed3eecb6-5a35-32d5-8af1-b152f9fe729e","product":{"name":"jodit","vendor":{"name":"xdan"}},"product_version":"\u003c 4.12.18"}],"vulnerabilityVendor":[{"id":"c67bf262-00a7-3d7f-a8a2-7e17b1afee4c","vendor":{"name":"xdan"}}]}},{"id":"690d819c-e243-3047-acbd-9ed4dbb61492","vulnerability":{"id":"GHSA-5957-5c94-3v7w","description":"Jodit has prototype pollution via Jodit.configure() / ConfigMerge","datePublished":"Jul 31, 2026, 7:10:16 PM","dateUpdated":"Jul 31, 2026, 7:10:17 PM","baseScore":0.0,"references":"https://github.com/xdan/jodit/security/advisories/GHSA-5957-5c94-3v7w\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54756\nhttps://github.com/xdan/jodit/commit/d298397bc993793b17145806c15f7dae53f90104\nhttps://github.com/xdan/jodit\nhttps://github.com/xdan/jodit/releases/tag/4.12.18\n","enisa_id":"EUVD-2026-41139\n","aliases":"CVE-2026-54756\nGHSA-5957-5c94-3v7w\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}