Jodit Editor is a WYSIWYG editor written entirely in TypeScript that offers image editing capabilities. Versions before 4.12.26 are affected by prototype pollution via the Jodit.modules.Helpers.set(chain, value, obj) function, which walks a dot‑separated chain and creates or follows each segment without filtering potential prototype‑mutating keys. Because a chain that begins with or contains __proto__, constructor, or prototype reaches Object.prototype, an attacker who can supply a user‑controlled or partially user‑controlled key path to this helper can inject unexpected properties, bypass internal logic, cause denial of service, or trigger other secondary security issues. The vulnerability is addressed in version 4.12.26.

Jodit Editor, developed by xdan, is affected in all releases prior to 4.12.26. Any application that uses this editor and allows user input to be supplied as.

The CVSS score of 6.3 indicates medium severity, and the EPSS score of less than 1% indicates a very low in KEV. Based on the description, the likely attack vector is user input that the application forwards to Jodit.modules.Helpers.set via a key chain. If an attacker can supply a malicious key path in the editor content or configuration, they could exploit the flaw. No public exploits or proof‑of‑concept code are reported, but the potential for property injection makes it a worthwhile risk to address promptly.