The vulnerability allows untrusted input to modify JavaScript prototypes via the Jodit.configure() function, enabling prototype pollution. Without filtering special keys such as __proto__ or constructor during configuration merging, an attacker can corrupt Object.prototype, potentially breaking editor behavior or creating a foundation for additional attacks within the same application context. The weakness is a classic example of improper input validation (CWE‑1321).

Applications that embed the xdan:jodit package and initialize the editor with Jodit.configure(), passing configuration data sourced from an untrusted or partially trusted user, are affected. All releases of Jodit Editor older than 4.12.18 are vulnerable; versions 4.12.18 and newer contain the fix.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1 % reflects a low probability of exploitation in practice. The flaw is not listed in CISA’s KEV catalogue. Successful exploitation would require the attacker to supply malicious configuration to the editor’s configuration API. Based on the description, the likely attack vector is through injecting a crafted configuration object, possibly via user input fields or API endpoints that forward data to Jodit.configure. While this does not grant direct remote code execution or authentication bypass, it can compromise JavaScript runtime integrity, leading to defacement, denial of service, or a stepping‑stone for further attacks within the same process.