{"id":"CVE-2026-54756","aliases":["GHSA-5957-5c94-3v7w"],"title":"Jodit has prototype pollution via Jodit.configure() / ConfigMerge","summary":"Jodit has prototype pollution via Jodit.configure() / ConfigMerge","severity":"medium","cwe":["CWE-1321"],"vendor":"jodit","product":"jodit","ecosystem":"npm","affected":["jodit < 4.12.18"],"patched":["jodit 4.12.18"],"published":"2026-07-31","updated":"2026-07-31","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-5957-5c94-3v7w","references":[{"url":"https://github.com/xdan/jodit/security/advisories/GHSA-5957-5c94-3v7w"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54756"},{"url":"https://github.com/xdan/jodit/commit/d298397bc993793b17145806c15f7dae53f90104"},{"url":"https://github.com/xdan/jodit/releases/tag/4.12.18"},{"url":"https://github.com/advisories/GHSA-5957-5c94-3v7w"}],"tags":["ghsa","npm"],"epss":0.00462,"epssPercentile":0.39317,"ingestedAt":"2026-07-31T20:02:43.128Z","slug":"CVE-2026-54756","body":"## Overview\n\n### Summary\n`Jodit.configure(options)` — and the internal `ConfigMerge` / `ConfigProto` helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such as `controls` could reach and mutate `Object.prototype` (prototype pollution).\n\n### Affected\n- Package: `jodit` (npm)\n- Versions: `< 4.12.18`\n- Public API: `Jodit.configure(options)`\n\n### Proof of Concept\n```js\nimport { Jodit } from 'jodit';\ndelete Object.prototype.polluted;\nJodit.configure(JSON.parse('{\"controls\":{\"__proto__\":{\"polluted\":\"yes\"}}}'));\nconsole.log(({}).polluted); // \"yes\" (before the fix)\ndelete Object.prototype.polluted;\n```\n\n### Impact\nApplications that pass user-controlled or partially user-controlled configuration into `Jodit.configure()` could be vulnerable to prototype pollution: unexpected property injection, logic bypass, denial of service, or secondary security issues.\n\n### Patch\nFixed in 4.12.18 by rejecting `__proto__`, `constructor`, and `prototype` at every merge level in `ConfigMerge` and `ConfigProto`.\n\n### Credit\nResponsibly reported by Junming Wu.\n\n## Affected packages\n\n- `jodit < 4.12.18`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `jodit 4.12.18`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}