Jodit Editor versions prior to 4.12.18 merge user‑supplied configuration API without preventing keys that alter an object’s prototype. A configuration option such as controls can set properties on Object.prototype, potentially breaking normal editor behavior or causing unintended modifications to other code that relies on shared prototypes.

The vulnerability affects applications that embed the xdan:jodit package and initialize the editor with Jodit.configure(), passing configuration data that originates from an untrusted source. All releases before 4.12.18 are impacted; versions 4.12.18 and later are fixed.

The CVSS score ofifies the flaw as moderate severity. The EPSS score of less than 1 % indicates a low probability of real‑world exploitation, and the defect is not listed in the CISA KEV catalog. Successful exploitation would require an attacker to supply malicious configuration to the editor’s configuration API; it does not provide direct remote code execution or authentication bypass, but it can corrupt the JavaScript runtime by modifying Object.prototype, leading to broken functionality or a foothold for further attacks within the same application context.