---
id: CVE-2026-54756
aliases:
  - GHSA-5957-5c94-3v7w
title: Jodit has prototype pollution via Jodit.configure() / ConfigMerge
summary: Jodit has prototype pollution via Jodit.configure() / ConfigMerge
severity: medium
cwe:
  - CWE-1321
vendor: jodit
product: jodit
ecosystem: npm
affected:
  - jodit < 4.12.18
patched:
  - jodit 4.12.18
published: '2026-07-31'
updated: '2026-07-31'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-5957-5c94-3v7w'
references:
  - url: 'https://github.com/xdan/jodit/security/advisories/GHSA-5957-5c94-3v7w'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54756'
  - url: >-
      https://github.com/xdan/jodit/commit/d298397bc993793b17145806c15f7dae53f90104
  - url: 'https://github.com/xdan/jodit/releases/tag/4.12.18'
  - url: 'https://github.com/advisories/GHSA-5957-5c94-3v7w'
tags:
  - ghsa
  - npm
epss: 0.00462
epssPercentile: 0.37442
ingestedAt: '2026-07-31T20:02:43.128Z'
---

## Overview

### Summary
`Jodit.configure(options)` — and the internal `ConfigMerge` / `ConfigProto` helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such as `controls` could reach and mutate `Object.prototype` (prototype pollution).

### Affected
- Package: `jodit` (npm)
- Versions: `< 4.12.18`
- Public API: `Jodit.configure(options)`

### Proof of Concept
```js
import { Jodit } from 'jodit';
delete Object.prototype.polluted;
Jodit.configure(JSON.parse('{"controls":{"__proto__":{"polluted":"yes"}}}'));
console.log(({}).polluted); // "yes" (before the fix)
delete Object.prototype.polluted;
```

### Impact
Applications that pass user-controlled or partially user-controlled configuration into `Jodit.configure()` could be vulnerable to prototype pollution: unexpected property injection, logic bypass, denial of service, or secondary security issues.

### Patch
Fixed in 4.12.18 by rejecting `__proto__`, `constructor`, and `prototype` at every merge level in `ConfigMerge` and `ConfigProto`.

### Credit
Responsibly reported by Junming Wu.

## Affected packages

- `jodit < 4.12.18`

## Remediation

Upgrade to a patched release:

- `jodit 4.12.18`