---
id: CVE-2026-55886
title: 'jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set()'
summary: 'jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set()'
severity: medium
cwe:
  - CWE-1321
vendor: jodit
product: jodit
ecosystem: npm
affected:
  - jodit < 4.12.26
patched:
  - jodit 4.12.26
published: '2026-06-18'
updated: '2026-06-18'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-vpmm-x3fm-qr5c'
references:
  - url: 'https://github.com/xdan/jodit/security/advisories/GHSA-vpmm-x3fm-qr5c'
  - url: 'https://github.com/advisories/GHSA-vpmm-x3fm-qr5c'
tags:
  - ghsa
  - npm
ingestedAt: '2026-06-29T14:31:47.010Z'
epss: 0.00534
epssPercentile: 0.42663
---

## Overview

### Summary
`Jodit.modules.Helpers.set(chain, value, obj)` walks the dot-separated `chain`, creating and following each path segment, without filtering prototype-mutating keys. A chain that begins with (or contains) `__proto__`, `constructor`, or `prototype` lets the final assignment reach and mutate `Object.prototype` (prototype pollution).

### Affected
- Package: `jodit` (npm)
- Versions: `< 4.12.26`
- Public API: `Jodit.modules.Helpers.set(chain, value, obj)`

### Proof of Concept
```js
const { Jodit } = require('jodit');
delete Object.prototype.polluted;
Jodit.modules.Helpers.set('__proto__.polluted', 'yes', {});
console.log(({}).polluted); // "yes" (before the fix)
delete Object.prototype.polluted;
```

### Impact
Applications that pass a user-controlled or partially user-controlled key path into `Jodit.modules.Helpers.set()` could be vulnerable to prototype pollution (CWE-1321): unexpected property injection, logic bypass, denial of service, or secondary security issues.

### Patch
Fixed in 4.12.26 by rejecting any `chain` whose segments include `__proto__`, `constructor`, or `prototype`, reusing the same guard introduced for `Jodit.configure()` in 4.12.18.

### Credit
Responsibly reported by Junming Wu.

## Affected packages

- `jodit < 4.12.26`

## Remediation

Upgrade to a patched release:

- `jodit 4.12.26`