CVE-2026-62324

mediumCVSS 5.4covered by 1 sourcefirst seen 2026-07-31

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.

⚡ Watch CVE-2026-62324

Get an email if CVE-2026-62324 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

mediumCVE-2026-62324: Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31…nvd · 2026-07-31

External references

NVD record for CVE-2026-62324

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-62324 status](https://www.csirts.com/badge/CVE-2026-62324)](https://www.csirts.com/cve/CVE-2026-62324)