MEDIUM GitHub
CVE-2026-54756
Jodit has prototype pollution via Jodit.configure() / ConfigMerge
### Summary
`Jodit.configure(options)` — and the internal `ConfigMerge` / `ConfigProto` helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such as `controls` could reach and mutate `Object.prototype` (prototype pollution).
### Affected
- Package: `jodit` (npm)
- Versions: `< 4.12.18`
- Public API: `Jodit.configure(options)`
### Proof of Concept
```js
import { Jodit } from 'jodit'
Affected Products
- npm/jodit < 4.12.18
References
- https://github.com/advisories/GHSA-5957-5c94-3v7w
- https://github.com/xdan/jodit/security/advisories/GHSA-5957-5c94-3v7w
- https://nvd.nist.gov/vuln/detail/CVE-2026-54756
- https://github.com/xdan/jodit/commit/d298397bc993793b17145806c15f7dae53f90104
This medium severity vulnerability was published on 2026-07-31 via GitHub. Affected: npm/jodit < 4.12.18.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.