AIKIDO-2026-734991

TL;DR

The HTML sanitizer in jodit checks an element's href for executable schemes with a bare case-sensitive comparison that does not strip control bytes, tabs, or newlines, unlike the normalization applied to every other URL attribute. An attacker can store a javascript: link obfuscated with uppercase letters, a leading control byte, or an embedded tab or newline so it survives sanitization and persists in the stored editor value. When another user clicks the link in any view that renders that stored content, the attacker-controlled script executes in the page's origin. The fix routes href through the same isDangerousUrl normalization that strips control characters and lowercases the value before matching the scheme.