CyberRota Analysis
AI-GeneratedThe Jodit Editor, prior to version 4.12.31, is vulnerable due to its sanitizeHTMLElement method not properly normalizing `javascript:` href values, which allows attackers to bypass filtering and execute malicious scripts through specially crafted links. This vulnerability poses a medium risk, as it can lead to unauthorized script execution when users interact with affected links. Developers and organizations utilizing Jodit Editor should prioritize upgrading to version 4.12.31 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.