Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. Versions prior to 4.12.26 are vulnerable to Prototype Pollution through Jodit.modules.Helpers.set(chain, value, obj), which walks a dot‑separated chain, creating and following each path segment without filtering prototype‑mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype. Applications that pass a user‑controlled or partially controlled key path into Jodit.modules.Helpers.set() could be vulnerable, causing unexpected property injection, logic bypass, denial of service, or secondary security issues. This issue has been fixed in version 4.12.26.

Jodit Editor, developed by xdan, is affected in all releases prior to 4.12.26. Any application that embeds this editor and allows user input to be passed to Jodit.modules.Helpers.set() may be vulnerable.

The CVSS score of 6.3 indicates medium severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. Because the flaw is triggered by user‑controlled or partially controlled key paths, the likely attack vector involves malicious input forwarded to the helper function. If an attacker supplies a chain that manipulates Object.prototype, they can achieve property injection. No public exploits or proof‑of‑concept code are reported, but the potential for property injection makes this a risk worth addressing promptly.