The Jodit Editor’s built‑in clean‑html sanitizer can be bypassed by embedding a MathML or style element that conceals a dangerous tag. A crafted payload hides an <img> tag with an onload attribute (or other non‑onerror handler) from the sanitizer’s element walk. When attacker‑controlled HTML is supplied to the editor’s value‑setting or insertion APIs, the sanitized output still contains the live event handler. If the consuming application renders that output via innerHTML, the handler executes automatically, delivering a Mutation XSS vector without any user interaction. This flaw is classified under CWE‑79 and CWE‑83.

All releases of Jodit Editor from the xdan vendor dated before 4.12.28 are vulnerable. Any deployment that provides attacker‑controlled HTML to the editor’s value‑setting or insertion mechanisms and later renders that content to the DOM using innerHTML or a similar property will be affected.

The CVSS score of 7.2 classifies the issue as high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Because no user interaction is required, an attacker can trigger the embedded event handler automatically on any exposed input surface, making this risk significant for exposed applications.