Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value, potentially causing Mutation XSS. When an application supplies attacker-influenced HTML to the editor's value-set or insertion paths, the sanitized output still contains a live <img ... onload=...> (or another non-onerror handler such as onfocus). A consumer that renders that output (element.innerHTML = editor.value) executes the handler with no user interaction. This issue has been fixed in version 4.12.28.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-01 | 1 | Disclosure1 |
| 2026-08-29 | 1 | Patch1 |
| 2026-09-05 | 1 | Patch1 |
Mutation XSS in Jodit (CVE-2026-58263) exposes many developers to security weaknesses. Check your editor version and patch if needed. Protect your users! https://github.com/advisories/GHSA-rxcw-mc6f-6hr3
Post summary
A newly disclosed Mutation XSS vulnerability (CVE-2026-58263) in the Jodit editor is addressed by advising users to check their editor version and apply patches; no exploit code or active attacks are reported.
Mutation XSS in Jodit (CVE-2026-58263) exposes apps to security weaknesses. Developers using this editor should check and patch their versions to mitigate risks. https://github.com/advisories/GHSA-rxcw-mc6f-6hr3
Post summary
The advisory identifies a Mutation XSS flaw (CVE‑2026‑58263) in Jodit and urges developers to patch their installations, without providing PoC or exploit details, and no active exploitation is reported.
CVE-2026-58263 Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.28, the built-in clean-html sanitizer … https://www.cve.org/CVERecord?id=CVE-2026-58263
Post summary
The text announces CVE‑2026‑58263, indicating a flaw in Jodit Editor’s clean‑html sanitizer for versions before 4.12.28, but provides no exploitation or remediation details.