AIKIDO-2026-615527

TL;DR

The HTML sanitizer in jodit walks parsed content as elements, but markup smuggled as style rawtext inside a MathML or SVG foreign-content carrier is not an element during that walk and escapes cleaning. A later serialize-and-reparse hoists the hidden markup, such as an img carrying an on* handler, into a live HTML node with its event handler intact. An application that re-renders the editor value then runs attacker-supplied script with no user interaction, producing stored cross-site scripting in the default configuration. The fix removes HTML-namespace elements the parser placed inside math or svg outside integration points before the walk, including nested carriers.