CVE-2026-62324

MediumCVSS 5.4/10Last modified Oct 23, 2026

Description

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-83

Affected software

No affected versions have been published.

Timeline

Published: Jul 31, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-623259.1goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go passw CVE-2026-623266.5Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the b CVE-2026-623279.19Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve pla CVE-2026-623287.59Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensit CVE-2026-623434.7ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 an CVE-2026-623485.4TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated CVE-2026-623498.3TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/pa CVE-2026-62359.8The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all ver CVE-2026-623507.2TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privile CVE-2026-623517.5TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transD CVE-2026-623535.4TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetTo CVE-2026-623544.3Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to sub