CVE-2026-58263: Mutation Cross-Site Scripting (mXSS) in Jodit Editor clean-html Sanitizer

Jodit Editor is a client-side, browser-based WYSIWYG editor containing advanced text processing, image, and file management functions. To protect against malicious cross-site scripting vectors, the application exposes a built-in input sanitization engine via the clean-html plugin. This plugin processes untrusted HTML inputs, aiming to neutralize malicious tags and properties prior to rendering.\n\nThe attack surface exists on the client-side parsing interface where rich text is processed. By leveraging the discrepancy in how different browser engines handle parsing state transitions, attackers can exploit CVE-2026-58263 to bypass the sanitization process entirely. The vulnerability belongs to the Mutation Cross-Site Scripting class, specifically involving the abuse of foreign namespaces like MathML and SVG combined with HTML elements that transition the parsing engine's parsing rules.\n\nThe consequences of this vulnerability are severe. Successful exploitation results in the execution of arbitrary JavaScript code within the victim's browser context. This execution is achieved with zero user interaction upon the rendering of the poisoned HTML within the Jodit Editor window.

Mutation Cross-Site Scripting relies on a parsing differential between the inert DOM structure utilized by a sanitizer and the live DOM structure initialized by the browser when displaying content. During the sanitization phase, Jodit places the raw HTML inside an inert container, such as a template element or an offline document fragment, to prevent execution. The sanitizer then walks the resulting DOM tree to inspect and purge non-whitelisted tags or event attributes.\n\nIn the vulnerable versions of Jodit Editor, the clean-html sanitizer does not account for the structural mutation rules dictated by the HTML5 parsing specification when nesting HTML elements inside foreign namespaces. When the browser parser encounters a math or svg tag, it transitions into a foreign content parsing mode. In this mode, tags like style are not treated as standard HTML RAWTEXT elements, but are parsed according to MathML parsing behaviors.\n\nBy nesting a table and rawtext elements such as style within a MathML element like mtext, the attacker constructs a payload that changes its structure during parsing and serialization. In the inert sandbox, the nested img node is viewed as harmless raw text inside the style tag. Jodit's DOM walker fails to detect the element because it exists purely as a text node at that stage.\n\nDuring serialization, Jodit extracts the content as a string using element.innerHTML. When the host application parses this serialized string a second time to render it in the live DOM, the HTML5 foster-parenting rules trigger. The browser parser detects the invalid nesting of a table structure within the MathML namespace, prematurely exits the MathML context, and hoists the nested nodes. The previously inert text inside the style block is parsed as a real HTML image tag, restoring its event attributes and executing the payload.\n\nmermaid\ngraph LR\n A["Poisoned Payload Input"] --> B["Inert DOM Parsing"]\n B --> C["Sanitization Walk"]\n C --> D["HTML String Serialization"]\n D --> E["Live DOM Insertion"]\n E --> F["Foster-Parenting Breakout"]\n F --> G["Active XSS Execution"]\n

To understand the mechanical breakdown of this vulnerability, we must examine the implementation of Jodit's sanitizer. The vulnerable component failed to validate elements nested within foreign namespaces before traversing the tree for event attributes. This omission allowed structural elements to bypass sanitization in an inert text state.\n\nThe fix introduced in version 4.12.28 implements a proactive detection pass before the main tree walk. It identifies smuggled HTML elements that are incorrectly nested within foreign content contexts. The following typescript snippet highlights the validation logic implemented in the patch:\n\ntypescript\nconst HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';\n\nconst HTML_INTEGRATION_POINTS = new Set([\n\t'foreignobject',\n\t'annotation-xml',\n\t'desc',\n\t'title'\n]);\n\nfunction isSmuggledForeignHtml(elm: Element): boolean {\n\tif (elm.namespaceURI !== HTML_NAMESPACE || elm.closest('math,svg') === null) {\n\t\treturn false;\n\t}\n\n\tfor (let parent = elm.parentElement; parent; parent = parent.parentElement) {\n\t\tconst name = parent.nodeName.toLowerCase();\n\n\t\tif (name === 'math' || name === 'svg') {\n\t\t\tbreak;\n\t\t}\n\n\t\tif (HTML_INTEGRATION_POINTS.has(name)) {\n\t\t\treturn false;\n\t\t}\n\t}\n\n\treturn true;\n}\n\n\nBefore executing the standard sanitization walk, the patch queries all child elements of math and svg containers. Any element determined to be smuggled foreign HTML is removed safely from the tree. This prevents the browser's live parser from encountering the nested table structure that triggers foster-parenting during serialization and subsequent rendering.

Exploitation of CVE-2026-58263 does not require authentication or complex configurations. The attacker must only possess the ability to submit structured HTML content to an endpoint or an interface rendered within the Jodit WYSIWYG editor.\n\nThe core of the payload relies on the browser's implementation of error-recovery algorithms. By structuring the markup with math, mtext, table, mglyph, and style tags, the parser's state is manipulated. Inside the style container, the attacker places a raw image tag with inline execution attributes.\n\nhtml\n<math>\n <mtext>\n <table>\n <mglyph>\n <style>\n <img src='data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7' onload='alert(document.domain)' onerror='alert(document.domain)' onfocus='alert(document.domain)' autofocus tabindex='0'>\n </style>\n </mglyph>\n </table>\n </mtext>\n</math>\n\n\nWhen this input is serialized, the output string remains structurally identical. However, when the live browser engine executes the assignment to innerHTML, the nesting rules are evaluated. The presence of the table element forces the parser to eject from the MathML context and process the downstream tokens as standard HTML. The img tag is hoisted out of the style block and parsed into a live node, immediately triggering the onload, onerror, or onfocus attributes.

The impact of this vulnerability is classified as high, carrying a CVSS base score of 7.2. Since the payload executes inside the client-side browser environment, the immediate consequence is the arbitrary execution of JavaScript in the context of the victim's session. This allows for session hijacking, local storage data extraction, and unauthorized action execution on behalf of the user.\n\nThe scope of the vulnerability is changed, reflecting that compromise of the editor's sandboxed parsing environment leads directly to compromise of the surrounding web application. This vector bypasses traditional client-side mitigations like basic HTML sanitizers and simple input sanitization filters.\n\nAdditionally, although the EPSS score indicates low active exploitation in the wild, the publication of the proof of concept in unit tests lowers the barrier to entry for constructing functional exploits. Applications using Jodit to display user-generated rich text are at direct risk of client-side compromise.

Remediation of CVE-2026-58263 requires updating the Jodit Editor deployment to version 4.12.28 or above. This version contains the isSmuggledForeignHtml check inside the safeHTML module, which stops the serialization of hazardous nested namespaces.\n\nWhere updating is not immediately feasible, organizations must employ server-side defenses. A robust HTML sanitizer such as DOMPurify should be executed on the server before rich text content is stored in databases or rendered back to other users. Client-side editors should not be treated as a single point of defense.\n\nImplementing a strict Content Security Policy (CSP) provides an additional layer of security. By enforcing policies such as restricting inline script execution and disabling the evaluation of dynamic code, the execution of injected mXSS payloads can be successfully blocked even if the sanitizer is bypassed.