Junming Wu

**Name of the Vulnerable Software and Affected Versions** Jodit Editor versions prior to 4.12.18 **Description** Jodit Editor is a WYSIWYG editor written in TypeScript. The `Jodit.configure(options)` function, along with internal `ConfigMerge` and `ConfigProto` helpers, merges user-supplied options into the editor configuration without filtering prototype-mutating keys. This can lead to Prototype Pollution, where a payload nested under a plain-object option like `controls` can mutate `Object.prototype`. Applications that pass user-controlled or partially user-controlled configuration into `Jodit.configure()` are susceptible to this issue. **Recommendations** Update to version 4.12.18.

**Name of the Vulnerable Software and Affected Versions** Jodit Editor versions prior to 4.12.26 **Description** Prototype pollution occurs when an attacker can manipulate the prototype of an object, potentially leading to property injection, logic bypass, denial of service, or other security issues. The issue exists in the `Jodit.modules.Helpers.set(chain, value, obj)` function, which processes a dot-separated `chain` to set values without filtering keys that can mutate the prototype. If a `chain` contains ` proto `, `constructor`, or `prototype`, the final assignment can mutate `Object.prototype`. This is particularly risky for applications that pass user-controlled key paths into this function. **Recommendations** Update Jodit Editor to version 4.12.26. As a temporary workaround, restrict or sanitize any user-controlled input passed to the `Jodit.modules.Helpers.set()` function to ensure it does not contain ` proto `, `constructor`, or `prototype` keys.