AIKIDO-2026-115756
jodit is vulnerable to Prototype Pollution
50
Medium Risk
This Affects:
joditTL;DR
Prototype pollution was possible via Jodit.modules.Helpers.set(chain, value, obj) because dot-chains like __proto__.polluted could traverse unsafe keys and mutate Object.prototype (CWE-1321). Version 4.12.26 fixes this by rejecting/bailing out when any chain segment is __proto__, constructor, or prototype, and adds tests to ensure Object.prototype remains unpolluted.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
jodit is vulnerable to Prototype Pollution in versions 0.0.1 - 4.12.25.
How to fix this
Upgrade the jodit library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant