Answer in brief
CVE-2026-65841 records a Medium severity xss vulnerability in Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Answer in brief
CVE-2026-65841 records a Medium severity xss vulnerability in Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Update jodit to 4.13.6 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanXSS describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-65841 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| joditnpm | <4.13.6 | 4.13.6 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-65841 records a Medium severity xss vulnerability in Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for jodit.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate jodit to 4.13.6 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanXSS describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-65841 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| joditnpm | <4.13.6 | 4.13.6 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-65841 records a Medium severity xss vulnerability in Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for jodit.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardA `<script>` element placed directly inside an `<svg>` (or MathML) container was not removed by Jodit's clean-html sanitizer. The deny/allow tag filter compared `node.nodeName` against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names — an SVG script reports `"script"`, not `"SCRIPT"` — so the default `denyTags` list (which includes `script`) did not match it. The script therefore survived in the editor value and serialized output, where it could execute when the content was loaded back into a page or editor. ### Proof of concept ```html <svg xmlns="http://www.w3.org/2000/svg" width="400" height="400" viewBox="0 0 124 124"> <rect width="124" height="124" rx="24" fill="#000000"></rect> <script type="text/javascript">alert(document.domain);</script> </svg> ``` Load the payload into the editor (e.g. via source mode) and the `<script>` is preserved in `editor.value` and executes. ### Impact Stored / DOM cross-site scripting. An application that persists editor output and later renders or re-opens it in Jodit can have attacker-supplied script run in a victim's (e.g. an administrator's) authenticated browser context. ### Patch Fixed in **4.13.6**: the deny/allow lookup now normalises the tag name to upper case before matching, so a foreign namespace can no longer bypass the filter, while `allowTags` is still honoured. ### Workaround Upgrade to 4.13.6 or later. Server-side sanitization of stored HTML mitigates in the interim. ### Credit Reported by Roman Kis (@CrownKingClown).
A `<script>` element placed directly inside an `<svg>` (or MathML) container was not removed by Jodit's clean-html sanitizer. The deny/allow tag filter compared `node.nodeName` against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names — an SVG script reports `"script"`, not `"SCRIPT"` — so the default `denyTags` list (which includes `script`) did not match it. The script therefore survived in the editor value and serialized output, where it could execute when the content was loaded back into a page or editor. ### Proof of concept ```html <svg xmlns="http://www.w3.org/2000/svg" width="400" height="400" viewBox="0 0 124 124"> <rect width="124" height="124" rx="24" fill="#000000"></rect> <script type="text/javascript">alert(document.domain);</script> </svg> ``` Load the payload into the editor (e.g. via source mode) and the `<script>` is preserved in `editor.value` and executes. ### Impact Stored / DOM cross-site scripting. An application that persists editor output and later renders or re-opens it in Jodit can have attacker-supplied script run in a victim's (e.g. an administrator's) authenticated browser context. ### Patch Fixed in **4.13.6**: the deny/allow lookup now normalises the tag name to upper case before matching, so a foreign namespace can no longer bypass the filter, while `allowTags` is still honoured. ### Workaround Upgrade to 4.13.6 or later. Server-side sanitization of stored HTML mitigates in the interim. ### Credit Reported by Roman Kis (@CrownKingClown).