npmPackage

jodit

7 known vulnerabilities (1 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release: 4.19.9 (Nov 6, 2026): no advisory affects it
Newest unaffected release: 4.19.9 (Nov 6, 2026), the latest release
Advisories: 7 · 1 high, 5 medium

Weekly downloads: 274.2K
Dependents: 76
Releases: 500+ since 3.2.15 (Nov 1, 2018)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-65841
Affects 3.2.15 to 4.13.5 (4.13.6 is outside it)
CVE-2026-62324
Affects 3.2.15 to 4.12.30 (4.12.31 is outside it)
CVE-2026-58263
Affects 3.2.15 to 4.12.27 (4.12.28 is outside it)
CVE-2026-54756
Affects 3.2.15 to 4.12.17 (4.12.18 is outside it)
CVE-2026-55886
Affects 3.2.15 to 4.12.25 (4.12.26 is outside it)
CVE-2023-42399
Affects 4.0.0-beta.86 (4.0.0-beta.87 is outside it)
CVE-2022-23461
Affects 3.2.15 to 3.24.2 (3.24.3 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 7

CVE-2026-65841Medium 5.3
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
Affected: fixed in 4.13.6.
Fixed in 4.13.6 (released Jul 21, 2026, 10 days before disclosure).
The latest release, 4.19.9, is not affected.
55% of jodit downloads last week were affected versions (165.2K).
CVE-2026-62324Medium 5.4
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
Affected: fixed in 4.12.31.
Fixed in 4.12.31 (released Jun 26, 2026, 35 days before disclosure).
The latest release, 4.19.9, is not affected.
52% of jodit downloads last week were affected versions (155K).
CVE-2026-58263High 7.2
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
Affected: fixed in 4.12.28.
Fixed in 4.12.28 (released Jun 22, 2026, 9 days before disclosure).
The latest release, 4.19.9, is not affected.
51% of jodit downloads last week were affected versions (153.3K).
CVE-2026-54756Medium 6.3
Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge
Affected: fixed in 4.12.18.
Fixed in 4.12.18 (released Jun 9, 2026, 22 days before disclosure).
The latest release, 4.19.9, is not affected.
50% of jodit downloads last week were affected versions (150.2K).
CVE-2026-55886Medium 6.3
Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()
Affected: fixed in 4.12.26.
Fixed in 4.12.26 (released Jun 16, 2026, 15 days before disclosure).
The latest release, 4.19.9, is not affected.
51% of jodit downloads last week were affected versions (152.2K).
CVE-2023-42399Unrated
Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via…
Affected: versions 4.0.0-beta.86.
Fixed in 4.0.1 (released Jan 8, 2024, 111 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 4.19.9, is not affected.
<0.1% of jodit downloads last week were affected versions (30).
CVE-2022-23461Medium 5.4
Cross-Site Scripting (XSS) in Jodit Editor
Affected: through 3.24.2.
Fixed in 3.24.3 (released Feb 5, 2023, 134 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 4.19.9, is not affected.
3.6% of jodit downloads last week were affected versions (10.7K).