https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:08:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-343503 EUVD-2026-343503 https://cve.radiocsirt.org/vuln/euvd-2026-343503 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65841 <p>Jodit Editor is a WYSIWYG editor with a built-in file browser &amp; image editor. Prior to 4.13.6, Jodit&#39;s clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.</p> <p>Jodit Editor is a WYSIWYG editor with a built-in file browser &amp; image editor. Prior to 4.13.6, Jodit&#39;s clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issue is fixed in version 4.13.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-65841 https://cve.radiocsirt.org/vuln/ghsa-45qg-252v-3f7p <p><strong>Affected:</strong> npm: jodit</p> <p>A `&lt;script&gt;` element placed directly inside an `&lt;svg&gt;` (or MathML) container was not removed by Jodit&#39;s clean-html sanitizer.</p> <p>The deny/allow tag filter compared `node.nodeName` against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names — an SVG script reports `&#34;script&#34;`, not `&#34;SCRIPT&#34;` — so the default `denyTags` list (which includes `script`) did not match it. The script therefore survived in the editor value and serialized output, where it could execute when the content was loaded back into a page or editor.</p> <p>### Proof of concept</p> <p>```html &lt;svg xmlns=&#34;http://www.w3.org/2000/svg&#34; width=&#34;400&#34; height=&#34;400&#34; viewBox=&#34;0 0 124 124&#34;&gt; &lt;rect width=&#34;124&#34; height=&#34;124&#34; rx=&#34;24&#34; fill=&#34;#000000&#34;&gt;&lt;/rect&gt; &lt;script type=&#34;text/javascript&#34;&gt;alert(document.domain);&lt;/script&gt; &lt;/svg&gt; ```</p> <p>Load the payload into the editor (e.g. via source mode) and the `&lt;script&gt;` is preserved in `editor.value` and executes.</p> <p>### Impact</p> <p>Stored / DOM cross-site scripting. An application that persists editor output and later renders or re-opens it in Jodit can have attacker-supplied script run in a victim&#39;s (e.g. an administrator&#39;s) authenticated browser context.</p> <p>### Patch</p> <p>Fixed in **4.13.6**: the deny/allow lookup now normalises the tag name to upper case before matching, so a foreign namespace can no longer bypass the filter, while `allowTags` is still honoured.</p> <p>### Workaround</p> <p>Upgrade to 4.13.6 or later. Server-side sanitization of stored HTML mitigates in the in…</p> <p><strong>Affected:</strong> npm: jodit</p> <p>A `&lt;script&gt;` element placed directly inside an `&lt;svg&gt;` (or MathML) container was not removed by Jodit&#39;s clean-html sanitizer.</p> <p>The deny/allow tag filter compared `node.nodeName` against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names — an SVG script reports `&#34;script&#34;`, not `&#34;SCRIPT&#34;` — so the default `denyTags` list (which includes `script`) did not match it. The script therefore survived in the editor value and serialized output, where it could execute when the content was loaded back into a page or editor.</p> <p>### Proof of concept</p> <p>```html &lt;svg xmlns=&#34;http://www.w3.org/2000/svg&#34; width=&#34;400&#34; height=&#34;400&#34; viewBox=&#34;0 0 124 124&#34;&gt; &lt;rect width=&#34;124&#34; height=&#34;124&#34; rx=&#34;24&#34; fill=&#34;#000000&#34;&gt;&lt;/rect&gt; &lt;script type=&#34;text/javascript&#34;&gt;alert(document.domain);&lt;/script&gt; &lt;/svg&gt; ```</p> <p>Load the payload into the editor (e.g. via source mode) and the `&lt;script&gt;` is preserved in `editor.value` and executes.</p> <p>### Impact</p> <p>Stored / DOM cross-site scripting. An application that persists editor output and later renders or re-opens it in Jodit can have attacker-supplied script run in a victim&#39;s (e.g. an administrator&#39;s) authenticated browser context.</p> <p>### Patch</p> <p>Fixed in **4.13.6**: the deny/allow lookup now normalises the tag name to upper case before matching, so a foreign namespace can no longer bypass the filter, while `allowTags` is still honoured.</p> <p>### Workaround</p> <p>Upgrade to 4.13.6 or later. Server-side sanitization of stored HTML mitigates in the in…</p> https://cve.radiocsirt.org/vuln/ghsa-45qg-252v-3f7p