What is CVE-2026-62324?
CVE-2026-62324 is a URL sanitization vulnerability in Jodit Editor's sanitizeHTMLElement method, where the isDangerousUrl function fails to normalize javascript: href values before scheme validation, allowing bypass via case variants, control-byte prefixes, and embedded whitespace characters. This affects all Jodit versions prior to 4.12.31, enabling XSS attacks. Users should immediately upgrade to version 4.12.31 or later.
Azərbaycanca: CVE-2026-62324 Jodit Editor-un sanitizeHTMLElement metodunda URL təmizlənmə zəifliyidir; hücumçu javascript: linklərinin sxemini müxtəlif case variantları, kontrol baytları və ya daxili boşluq simvolları ilə maskalayaraq XSS hücumu həyata keçirə bilər. Bu zəiflik 4.12.31 versiyasından əvvəlki bütün Jodit istifadəçilərini təsir edir. Təcili olaraq 4.12.31 və ya daha yuxarı versiyaya yenilənmə tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
Which function in Jodit Editor is affected by the CVE-2026-62324 vulnerability?
This vulnerability is related to URL sanitization in Jodit Editor's `sanitizeHTMLElement` method, specifically due to the `isDangerousUrl` function failing to normalize `javascript:` href values before scheme validation.
What version update is required to protect against CVE-2026-62324?
To protect against this vulnerability, users should immediately upgrade to Jodit Editor version 4.12.31 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.