https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:46:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-343795 EUVD-2026-343795 https://cve.radiocsirt.org/vuln/euvd-2026-343795 https://cve.radiocsirt.org/vuln/fkie_cve-2026-62324 <p>Jodit Editor is a WYSIWYG editor with a built-in file browser &amp; image editor. Prior to 4.12.31, Jodit&#39;s sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.</p> <p>Jodit Editor is a WYSIWYG editor with a built-in file browser &amp; image editor. Prior to 4.12.31, Jodit&#39;s sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-62324 https://cve.radiocsirt.org/vuln/ghsa-j839-gqq4-gf9j <p><strong>Affected:</strong> npm: jodit</p> <p>### Summary</p> <p>jodit&#39;s `sanitizeHTMLElement` neutralizes a `javascript:` `href` using a bare `href.trim().indexOf(&#39;javascript&#39;) === 0` check. This omits the normalization jodit applies to every other URL attribute: `isDangerousUrl` strips control bytes with `value.replace(/[\u0000-\u0020]+/g, &#39;&#39;)` and lowercases the value before testing the scheme. Because the `href` check does neither, it is bypassed by three obfuscation classes, all confirmed firing on click against the shipped 4.12.30 build:</p> <p>1. Case variants: `JAVASCRIPT:`, `Javascript:`, `jaVaScRiPt:` (the check is case-sensitive). 2. A leading C0 control byte, e.g. a `\x01` prefix before lowercase `javascript:` (`trim()` does not remove bytes in the `\x00`-`\x08` / `\x0e`-`\x1f` range, but the browser strips a leading control byte before resolving the scheme). 3. An embedded tab or newline inside the scheme, e.g. `java\tscript:` or `java\nscript:` (the browser strips tab/newline from a URL, but `indexOf(&#39;javascript&#39;)` sees the broken word and does not match).</p> <p>The dangerous href survives `editor.value =` assignment and the on-change LazyWalker, persisting in the stored editor value. A victim who clicks the link in any consumer that renders the stored value (readonly editor, server-rendered page, `innerHTML` consumer) runs attacker-controlled JS in that page&#39;s origin.</p> <p>### Details</p> <p>The check is in `sanitizeHTMLElement` at `src/core/helpers/html/safe-html.ts:213`:</p> <p>```js if (safeJavaScriptLink &amp;&amp; href &amp;&amp; href.trim().indexO…</p> <p><strong>Affected:</strong> npm: jodit</p> <p>### Summary</p> <p>jodit&#39;s `sanitizeHTMLElement` neutralizes a `javascript:` `href` using a bare `href.trim().indexOf(&#39;javascript&#39;) === 0` check. This omits the normalization jodit applies to every other URL attribute: `isDangerousUrl` strips control bytes with `value.replace(/[\u0000-\u0020]+/g, &#39;&#39;)` and lowercases the value before testing the scheme. Because the `href` check does neither, it is bypassed by three obfuscation classes, all confirmed firing on click against the shipped 4.12.30 build:</p> <p>1. Case variants: `JAVASCRIPT:`, `Javascript:`, `jaVaScRiPt:` (the check is case-sensitive). 2. A leading C0 control byte, e.g. a `\x01` prefix before lowercase `javascript:` (`trim()` does not remove bytes in the `\x00`-`\x08` / `\x0e`-`\x1f` range, but the browser strips a leading control byte before resolving the scheme). 3. An embedded tab or newline inside the scheme, e.g. `java\tscript:` or `java\nscript:` (the browser strips tab/newline from a URL, but `indexOf(&#39;javascript&#39;)` sees the broken word and does not match).</p> <p>The dangerous href survives `editor.value =` assignment and the on-change LazyWalker, persisting in the stored editor value. A victim who clicks the link in any consumer that renders the stored value (readonly editor, server-rendered page, `innerHTML` consumer) runs attacker-controlled JS in that page&#39;s origin.</p> <p>### Details</p> <p>The check is in `sanitizeHTMLElement` at `src/core/helpers/html/safe-html.ts:213`:</p> <p>```js if (safeJavaScriptLink &amp;&amp; href &amp;&amp; href.trim().indexO…</p> https://cve.radiocsirt.org/vuln/ghsa-j839-gqq4-gf9j