# jodit (npm) vulnerabilities 7 known vulnerabilities (1 high, 5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.19.9 (Nov 6, 2026): no advisory affects it - Newest unaffected release: 4.19.9 (Nov 6, 2026), the latest release - Weekly downloads: 274.2K - Dependents: 76 - Releases: 500+ since 3.2.15 (Nov 1, 2018) - Registry: https://www.npmjs.com/package/jodit - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-65841: 3.2.15 to 4.13.5 (4.13.6 is outside it) - CVE-2026-62324: 3.2.15 to 4.12.30 (4.12.31 is outside it) - CVE-2026-58263: 3.2.15 to 4.12.27 (4.12.28 is outside it) - CVE-2026-54756: 3.2.15 to 4.12.17 (4.12.18 is outside it) - CVE-2026-55886: 3.2.15 to 4.12.25 (4.12.26 is outside it) - CVE-2023-42399: 4.0.0-beta.86 (4.0.0-beta.87 is outside it) - CVE-2022-23461: 3.2.15 to 3.24.2 (3.24.3 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (7) ### [CVE-2026-65841](https://cve.now/CVE-2026-65841): Jodit has cross-site scripting (XSS) via \ nested in SVG that bypasses clean-html sanitization - Severity: Medium 5.3 - Published: Jul 31, 2026 - Affected: fixed in 4.13.6. - Fixed in 4.13.6 (released Jul 21, 2026, 10 days before disclosure). - The latest release, 4.19.9, is not affected. - 55% of jodit downloads last week were affected versions (165.2K). ### [CVE-2026-62324](https://cve.now/CVE-2026-62324): Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS - Severity: Medium 5.4 - Published: Jul 31, 2026 - Affected: fixed in 4.12.31. - Fixed in 4.12.31 (released Jun 26, 2026, 35 days before disclosure). - The latest release, 4.19.9, is not affected. - 52% of jodit downloads last week were affected versions (155K). ### [CVE-2026-58263](https://cve.now/CVE-2026-58263): Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier - Severity: High 7.2 - Published: Jul 1, 2026 - Affected: fixed in 4.12.28. - Fixed in 4.12.28 (released Jun 22, 2026, 9 days before disclosure). - The latest release, 4.19.9, is not affected. - 51% of jodit downloads last week were affected versions (153.3K). ### [CVE-2026-54756](https://cve.now/CVE-2026-54756): Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge - Severity: Medium 6.3 - Published: Jul 1, 2026 - Affected: fixed in 4.12.18. - Fixed in 4.12.18 (released Jun 9, 2026, 22 days before disclosure). - The latest release, 4.19.9, is not affected. - 50% of jodit downloads last week were affected versions (150.2K). ### [CVE-2026-55886](https://cve.now/CVE-2026-55886): Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set() - Severity: Medium 6.3 - Published: Jul 1, 2026 - Affected: fixed in 4.12.26. - Fixed in 4.12.26 (released Jun 16, 2026, 15 days before disclosure). - The latest release, 4.19.9, is not affected. - 51% of jodit downloads last week were affected versions (152.2K). ### [CVE-2023-42399](https://cve.now/CVE-2023-42399): Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via… - Severity: Unrated - Published: Sep 19, 2023 - Affected: versions 4.0.0-beta.86. - Fixed in 4.0.1 (released Jan 8, 2024, 111 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 4.19.9, is not affected. - <0.1% of jodit downloads last week were affected versions (30). ### [CVE-2022-23461](https://cve.now/CVE-2022-23461): Cross-Site Scripting (XSS) in Jodit Editor - Severity: Medium 5.4 - Published: Sep 24, 2022 - Affected: through 3.24.2. - Fixed in 3.24.3 (released Feb 5, 2023, 134 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 4.19.9, is not affected. - 3.6% of jodit downloads last week were affected versions (10.7K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/jodit Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.