AIKIDO-2026-11135

TL;DR

The jodit editor merges global and instance configuration through Jodit.configure() and internal ConfigMerge/ConfigProto helpers. Those merge paths copied nested keys from supplied option objects without blocking prototype-mutating names such as __proto__, so a payload nested under an existing plain-object option like controls could mutate Object.prototype. That enables prototype pollution when applications pass attacker-influenced configuration into those APIs, with possible logic bypass or secondary security impact. The patch rejects __proto__, constructor, and prototype at every merge level.