jodit@4.2.10

jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the clean-html. An attacker can execute arbitrary JavaScript code in the context of a user's browser by injecting a <script> element within an SVG container, which is not properly sanitized and is preserved in the editor's value and output. This can lead to the execution of attacker-supplied scripts when the content is rendered or re-opened in the editor.

Upgrade jodit to version 4.13.6 or higher.

jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser

Affected versions of this package are vulnerable to Prototype Pollution via the ConfigMerge and ConfigProto helpers in the configuration code. An attacker can mutate Object.prototype by supplying user-controlled configuration to Jodit.configure() with nested keys such as controls.__proto__, causing unexpected property injection that can alter application behavior or trigger denial of service in code that consumes merged options.

Upgrade jodit to version 4.12.18 or higher.

jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the safeHTML sanitizer in src/core/helpers/html/safe-html.ts and the clean-html plugin’s value-set/on-change sanitization paths. An attacker can execute a script in a victim’s page by supplying HTML that hides an event-bearing element inside a MathML/<style> rawtext carrier, then relying on a later reparse to hoist it back into a live HTML node. The sanitizer walks the inert parse tree instead of removing the smuggled foreign HTML itself, so editor.value can retain a live <img> or similar element with handlers such as onload or onfocus. When an application renders that stored value, the handler fires without user interaction, leading to XSS in any consumer that trusts the editor output.

Upgrade jodit to version 4.12.28 or higher.

jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser

Affected versions of this package are vulnerable to Prototype Pollution via the Jodit.modules.Helpers.set() function. An attacker can inject unexpected properties into Object.prototype by supplying a crafted chain containing __proto__, constructor, or prototype as path segments.

Upgrade jodit to version 4.12.26 or higher.

jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the rich text editor component, allowing an attacker to obtain sensitive information by sending a specially crafted payload.

There is no fixed version for jodit.