{"id":"EUVD-2026-41140","enisaUuid":"f6ab0fc7-cfaf-33f7-8706-4dd0c09975e7","description":"Jodit Editor is a WYSIWYG editor with a built-in file browser \u0026 image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/\u003cstyle\u003e carrier that hides a dangerous element from the sanitizer\u0027s element walk, so a no-interaction event handler survives into the editor value, potentially causing Mutation XSS. When an application supplies attacker-influenced HTML to the editor\u0027s value-set or insertion paths, the sanitized output still contains a live \u003cimg ... onload\u003d...\u003e (or another non-onerror handler such as onfocus). A consumer that renders that output (element.innerHTML \u003d editor.value) executes the handler with no user interaction. This issue has been fixed in version 4.12.28.","datePublished":"Jul 1, 2026, 8:35:35 PM","dateUpdated":"Jul 31, 2026, 7:07:55 PM","baseScore":7.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","references":"https://github.com/xdan/jodit/security/advisories/GHSA-rxcw-mc6f-6hr3\n","aliases":"CVE-2026-58263\nGHSA-rxcw-mc6f-6hr3\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"a42821c5-e4cc-3449-a19e-5599c02e97dd","product":{"name":"jodit","vendor":{"name":"xdan"}},"product_version":"\u003c 4.12.28"}],"enisaIdVendor":[{"id":"1c209ca1-642a-32e9-af9a-71c145679a3c","vendor":{"name":"xdan"}}],"enisaIdVulnerability":[{"id":"4683ab8c-b175-31a2-b818-79fb5a279cb3","vulnerability":{"id":"GHSA-rxcw-mc6f-6hr3","description":"Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier","datePublished":"Jul 31, 2026, 7:12:40 PM","dateUpdated":"Jul 31, 2026, 7:12:40 PM","baseScore":0.0,"references":"https://github.com/xdan/jodit/security/advisories/GHSA-rxcw-mc6f-6hr3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58263\nhttps://github.com/xdan/jodit/commit/0ebb61692cbe84f9abf10ac76dd594dbb6343b90\nhttps://github.com/xdan/jodit\nhttps://github.com/xdan/jodit/releases/tag/4.12.28\n","enisa_id":"EUVD-2026-41140\n","aliases":"CVE-2026-58263\nGHSA-rxcw-mc6f-6hr3\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"bb927aeb-bfb8-3bbb-8d3a-3453827d6f73","vulnerability":{"id":"CVE-2026-58263","description":"Jodit Editor is a WYSIWYG editor with a built-in file browser \u0026 image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/\u003cstyle\u003e carrier that hides a dangerous element from the sanitizer\u0027s element walk, so a no-interaction event handler survives into the editor value, potentially causing Mutation XSS. When an application supplies attacker-influenced HTML to the editor\u0027s value-set or insertion paths, the sanitized output still contains a live \u003cimg ... onload\u003d...\u003e (or another non-onerror handler such as onfocus). A consumer that renders that output (element.innerHTML \u003d editor.value) executes the handler with no user interaction. This issue has been fixed in version 4.12.28.","datePublished":"Jul 1, 2026, 8:35:35 PM","dateUpdated":"Jul 31, 2026, 7:07:55 PM","status":"PUBLISHED","baseScore":7.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","references":"https://github.com/xdan/jodit/security/advisories/GHSA-rxcw-mc6f-6hr3\n","enisa_id":"EUVD-2026-41140\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Nov 7, 2026, 7:21:40 AM","vulnerabilityProduct":[{"id":"e6ede65d-7357-32ff-9ee1-5306ad51172a","product":{"name":"jodit","vendor":{"name":"xdan"}},"product_version":"\u003c 4.12.28"}],"vulnerabilityVendor":[{"id":"74065e17-9a1e-3312-881e-687e94fef5c5","vendor":{"name":"xdan"}}]}}],"enisaIdAdvisory":[]}