CVE-2026-58263: Jodit Editor HTML Sanitization Bypass and Mutation XSS

Technical summary

CVE-2026-58263 is a Mutation XSS vulnerability in Jodit Editor's built-in HTML sanitizer. The vulnerability exploits the sanitizer's element-walking mechanism by using MathML and <style> elements as carriers to obscure dangerous elements during the sanitization process. This allows non-interaction event handlers (such as onload, onfocus, or onerror on img elements) to persist in the sanitized output. When downstream applications assign this output directly to the DOM via innerHTML or similar methods, the event handlers execute in the security context of the application, bypassing intended XSS protections. The attack requires no user interaction post-rendering.

Business impact

Organizations using Jodit Editor to accept and process user-supplied HTML face a significant XSS risk. If the editor's output is rendered in web applications without additional sanitization, attackers can execute arbitrary JavaScript in end-user browsers, potentially stealing session tokens, credentials, or sensitive data. The network-based attack vector with no authentication or interaction requirements means any internet-exposed Jodit instance accepting untrusted input is at risk. Content management systems, collaboration platforms, and form-based applications relying on Jodit are particularly exposed.

Affected systems

Jodit Editor versions prior to 4.12.28 are affected. The vendor has not disclosed a comprehensive list of dependent products. Organizations should audit their use of Jodit Editor in their own applications and any third-party software that bundles it. The vulnerability is present whenever Jodit is used to sanitize and then render untrusted HTML content.

Exploitability

Exploitation requires minimal complexity. An attacker simply crafts HTML with MathML/<style> carriers hiding dangerous event handlers, then delivers it via any input path the editor processes (value-set, insertion, paste, etc.). The attack surface is broad: any interface accepting user-supplied HTML that flows through Jodit's sanitizer and is subsequently rendered poses a risk. No user interaction is needed beyond the normal act of viewing or rendering the compromised content. The CVSS score of 7.2 (HIGH) reflects the network vector, low complexity, and scope change; impact is confidentiality and integrity loss.

Remediation

Upgrade Jodit Editor to version 4.12.28 or later. Organizations should prioritize this patch for production systems, especially those handling user-generated content or multi-tenant environments. In addition to patching, consider implementing secondary sanitization or Content Security Policy (CSP) restrictions to limit the impact of any future sanitizer bypasses. Review any stored content that may have been processed by vulnerable versions.

Patch guidance

Apply Jodit Editor version 4.12.28 or newer to all affected instances. Verify compatibility with your specific application integration before deploying; consult the Jodit project's release notes and migration guide. If you maintain a fork or custom build of Jodit, review the upstream fix in the 4.12.28 release to understand the sanitizer changes and apply equivalent logic. Test thoroughly in a staging environment to confirm both the patch's effectiveness and that your application's intended functionality is preserved.

Detection guidance

Monitor for Jodit Editor version usage in your application inventory. Scan dependencies via package managers (npm, yarn, etc.) to identify installed versions. For deployed applications, inspect HTML output generated by Jodit to detect anomalous MathML structures or hidden style tags that may indicate exploit attempts. Implement CSP headers to block inline script execution and restrict script sources, mitigating the impact of successful XSS. Server-side event logging and client-side XSS detection libraries can also help identify post-exploitation activity.

Why prioritize this

This vulnerability combines a high CVSS score (7.2) with broad attack surface and minimal complexity. The Mutation XSS pattern is particularly dangerous because it defeats developer expectations that sanitized HTML is safe to render. Network accessibility, lack of authentication requirements, and the ability to impact multiple users via stored XSS make this a priority patch, especially for content management and multi-user platforms.

Risk score, explained

The CVSS 3.1 score of 7.2 reflects: (1) Network-based attack vector (remote exploitation), (2) Low attack complexity (straightforward payload crafting), (3) No privilege or authentication required, (4) Changed scope (the vulnerability can affect resources beyond the vulnerable component), and (5) Low impact on both confidentiality and integrity (XSS enables data exfiltration and page manipulation). The absence of availability impact prevents a CRITICAL rating, but the cross-scope and web-based nature elevate it to HIGH.

Frequently asked questions