The Jodit Editor built‑in clean‑html sanitizer can be bypassed by MathML or style elements that conceal a dangerous tag from the element traversal. This allows an attacker to embed an <img> tag with an onload attribute or other non‑onerror handler such that the handler survives sanitization and is stored in the editor’s value. When the application later renders that sanitized value with innerHTML, the invisible event handler executes automatically with no user interaction, delivering a mutation XSS attack. The vulnerability is classified as CWE‑79 (Cross‑Site Scripting) and CWE‑83 (XSS via Shadowed Syntax).

All releases of the Jodit Editor from the xdan vendor dated before version 4.12.28 are affected. Any deployment that accepts attacker‑controlled HTML into the editor’s value‑setting or insertion APIs and later renders that content as innerHTML is vulnerable.

The CVSS score of 7.2 classifies this issue as high severity, while the EPSS score of under 1% indicates a low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Execution of the embedded event handler requires no user interaction; an attacker can trigger it automatically on any exposed input surface, making the risk significant for exposed applications. The attack vector involves supplying crafted HTML to the editor and having the application render that content directly with innerHTML or an equivalent method.