Jodit Editor’s sanitizeHTMLElement routine does not normalize javascript: href values before checking the URL scheme. Consequently, attackers can insert case‑variant or obfuscated javascript: links that bypass the filter and execute arbitrary script when a victim clicks a stored link in the editor content. The flaw is an injection flaw (CWE-79) and a failure to validate dangerous URLs (CWE-83), enabling attackers to compromise a user’s session and execute code in the victim’s browser.

All installations of Jodit Editor released prior to version 4.12.31 are affected. The product vendor is xdan. Any application that uses the editor to accept or display user‑supplied rich‑text content may be impacted if the editor’s sanitizeHTMLElement function is invoked without the fix implemented in 4.12.31.

The CVSS score is 5.4, indicating a moderate risk, and the EPSS score is below 1 %, so the probability that this vulnerability is actively exploited is low. Because the attack requires only a malicious link embedded in editor content, authenticated users can trigger the flaw without special privileges. The vulnerability is not listed in the CISA KEV catalog. The exploitation path is straightforward: a user or attacker creates content containing a javascript: link with a variant that evades the validator, stores it, and another user later clicks the link, triggering the attack.