CyberRota Analysis
AI-GeneratedJodit Editor versions prior to 4.13.6 are vulnerable due to a flaw in the clean-html denyTags filter, which fails to properly normalize foreign SVG or MathML script node names. This oversight allows potentially malicious script elements to remain executable within the editor's content when loaded, posing a risk of cross-site scripting (XSS) attacks. Organizations using Jodit Editor should prioritize upgrading to version 4.13.6 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.