{"id":"CVE-2026-55886","summary":"Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()","details":"Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. Versions prior to 4.12.26 are vulnerable to Prototype Pollution through Jodit.modules.Helpers.set(chain, value, obj), which walks the dot-separated chain, creating and following each path segment without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype. Applications that pass a user-controlled or partially user-controlled key path into Jodit.modules.Helpers.set() could be vulnerable, causing unexpected property injection, logic bypass, denial of service, or secondary security issues. This issue has been fixed in version 4.12.26.","aliases":["GHSA-vpmm-x3fm-qr5c"],"modified":"2026-07-08T08:13:46.064793590Z","published":"2026-07-01T20:25:43.632Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1321"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55886.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55886.json"},{"type":"ADVISORY","url":"https://github.com/xdan/jodit/security/advisories/GHSA-vpmm-x3fm-qr5c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55886"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xdan/jodit","events":[{"introduced":"0"},{"fixed":"abe7f7c4988cd0908328a7b23f455ba5f153c45f"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"fixed":"4.12.26"}]}}],"versions":["4.12.25","4.12.24","4.12.23","4.12.22","4.12.21","4.12.20","4.12.18","4.12.17","4.12.16","4.12.15","4.12.14","4.12.13","4.12.12","4.12.11","4.12.10","4.12.9","4.12.8","4.12.7","4.12.6","4.12.5","4.12.4","4.12.3","4.12.2","4.12.1","4.11.17","4.11.16","4.11.15","4.11.14","4.11.13","4.11.12","4.11.11","4.11.10","4.11.9","4.11.8","4.11.7","4.11.6","4.11.5","4.11.4","4.11.3","4.11.2","4.11.1","4.10.3","4.10.2","4.10.1","4.9.19","4.9.18","4.9.17","4.9.16","4.9.15","4.9.14","4.9.13","4.9.12","4.9.11","4.9.10","4.9.9","4.9.8","4.9.7","4.9.6","4.9.5","4.9.4","4.9.3","4.9.2","4.9.1","4.8.10","4.8.9","4.8.8","4.8.7","4.8.6","4.8.5","4.8.4","4.8.3","4.8.2","4.8.1","4.7.9","4.7.7","4.7.6","4.7.5","4.7.4","4.7.3","4.7.2","4.7.1","4.6.18","4.6.17","4.6.16","4.6.15","4.6.14","4.6.13","4.6.12","4.6.11","4.6.10","4.6.9","4.6.8","4.6.7","4.6.6","4.6.5","4.6.4","4.6.3","4.6.2","4.6.1","4.5.20","4.5.19","4.5.18","4.5.17","4.5.16","4.5.15","4.5.14","4.5.13","4.5.12","4.5.11","4.5.10","4.5.9","4.5.8","4.5.7","4.5.6","4.5.5","4.5.4","4.5.3","4.5.2","4.5.1","4.4.8","4.4.7","4.4.6","4.4.5","4.4.4","4.4.3","4.4.2","4.4.1","4.3.2","4.3.1","4.2.50","4.2.49","4.2.48","4.2.47","4.2.46","4.2.45","4.2.44","4.2.43","4.2.42","4.2.41","4.2.40","4.2.39","4.2.38","4.2.37","4.2.36","4.2.35","4.2.34","4.2.33","4.2.32","4.2.31","4.2.30","4.2.29","4.2.28","4.2.27","4.2.26","4.2.25","4.2.24","4.2.23","4.2.22","4.2.21","4.2.20","4.2.19","4.2.18","4.2.17","4.2.16","4.2.15","4.2.14","4.2.10","4.2.13","4.2.12","4.2.11","4.2.9","4.2.8","4.2.7","4.2.6","4.2.5","4.2.4","4.2.3","4.2.2","4.2.1","4.1.16","4.1.15","4.1.14","4.1.13","4.1.12","4.1.11","4.1.10","4.1.9","4.1.8","4.1.7","4.1.6","4.1.5","4.1.4","4.1.3","4.1.2","4.1.1","4.0.19","4.0.18","4.0.17","4.0.16","4.0.15","4.0.14","4.0.13","4.0.12","4.0.11","4.0.10","4.0.9","4.0.8","4.0.6","4.0.7","4.0.5","4.0.4","4.0.3","4.0.2","4.0.1","4.0.0-beta.121","4.0.0-beta.120","4.0.0-beta.119","4.0.0-beta.118","4.0.0-beta.117","4.0.0-beta.116","4.0.0-beta.115","4.0.0-beta.114","4.0.0-beta.113","4.0.0-beta.112","4.0.0-beta.111","4.0.0-beta.110","4.0.0-beta.109","4.0.0-beta.108","4.0.0-beta.107","4.0.0-beta.106","4.0.0-beta.105","4.0.0-beta.104","4.0.0-beta.103","4.0.0-beta.102","4.0.0-beta.101","4.0.0-beta.100","4.0.0-beta.99","4.0.0-beta.98","4.0.0-beta.97","4.0.0-beta.96","4.0.0-beta.95","4.0.0-beta.94","4.0.0-beta.93","4.0.0-beta.92","4.0.0-beta.91","4.0.0-beta.90","4.0.0-beta.89","4.0.0-beta.88","4.0.0-beta.87","4.0.0-beta.86","4.0.0-beta.85","4.0.0-beta.84","4.0.0-beta.83","4.0.0-beta.82","4.0.0-beta.81","4.0.0-beta.80","4.0.0-beta.78","4.0.0-beta.77","4.0.0-beta.76","4.0.0-beta.75","4.0.0-beta.74","4.0.0-beta.70","4.0.0-beta.69","4.0.0-beta.68","4.0.0-beta.67","4.0.0-beta.66","4.0.0-beta.65","4.0.0-beta.64","4.0.0-beta.63","4.0.0-beta.62","4.0.0-beta.61","4.0.0-beta.60","4.0.0-beta.59","4.0.0-beta.58","4.0.0-beta.57","4.0.0-beta.56","4.0.0-beta.55","4.0.0-beta.54","4.0.0-beta.53","4.0.0-beta.52","4.0.0-beta.51","4.0.0-beta.49","4.0.0-beta.48","4.0.0-beta.47","4.0.0-beta.46","4.0.0-beta.45","4.0.0-beta.44","4.0.0-beta.43","4.0.0-beta.42","4.0.0-beta.41","4.0.0-beta.40","4.0.0-beta.39","4.0.0-beta.38","4.0.0-beta.37","4.0.0-beta.36","4.0.0-beta.35","4.0.0-beta.34","4.0.0-beta.33","4.0.0-beta.32","4.0.0-beta.31","4.0.0-beta.30","4.0.0-beta.29","4.0.0-beta.28","4.0.0-beta.27","4.0.0-beta.26","4.0.0-beta.25","4.0.0-beta.24","4.0.0-beta.23","4.0.0-beta.22","4.0.0-beta.21","4.0.0-beta.20","4.0.0-beta.19","4.0.0-beta.18","4.0.0-beta.17","4.0.0-beta.16","4.0.0-beta.15","4.0.0-beta.14","4.0.0-beta.13","4.0.0-beta.12","4.0.0-beta.11","4.0.0-beta.10","4.0.0-beta.9","4.0.0-beta.8","4.0.0-beta.7","4.0.0-beta.6","3.24.7","3.24.6","3.24.5","3.24.4","3.24.3","3.24.2","3.24.1","3.23.3","3.23.2","3.23.1","3.22.1","3.21.5","3.21.4","3.21.3","3.20.4","3.20.3","3.20.2","3.20.1","3.19.5","3.19.4","3.19.3","3.19.2","3.19.1","3.18.9","3.18.8","3.18.7","3.18.6","3.18.5","3.18.4","3.18.3","3.18.2","3.17.1","3.16.6","3.16.5","3.16.4","3.16.3","3.16.2","3.16.1","3.15.3","3.15.2","3.15.1","3.14.3","3.14.2","3.14.1","3.13.6","3.13.5","3.13.4","3.13.3","3.13.2","3.13.1","3.12.5","3.12.4","3.12.3","3.12.2","3.11.4","3.11.3","3.11.2","3.11.1","3.10.2","3.10.1","3.9.6","3.9.4","3.9.3","3.9.2","3.8.8","3.8.7","3.8.6","3.8.5","3.8.4","3.8.3","3.8.2","3.8.1","3.7.2","3.7.1","3.6.18","3.6.17","3.6.16","3.6.15","3.6.14","3.6.13","3.6.12","3.6.11","3.6.9","3.6.8","3.6.7","3.6.6","3.6.5","3.6.4","3.6.3","3.6.2","3.6.1","3.5.4","3.5.3","3.5.2","3.5.1","3.4.29","3.4.28","3.4.27","3.4.26","3.4.25","3.4.24","3.4.23","3.4.22","3.4.21","3.4.20","3.4.19","3.4.18","3.4.17","3.4.16","3.4.15","3.4.14","3.4.12","3.4.11","3.4.10","3.4.9","3.4.8","3.4.6","3.4.5","3.4.4","3.4.3","3.4.2","3.4.1","3.3.24","3.3.23","3.3.22","3.3.21","3.3.20","3.3.19","3.3.18","3.3.17","3.3.16","3.3.15","3.3.14","3.3.13","3.3.12","3.3.10","3.3.8","3.3.2","3.3.1","3.2.65","3.2.64","3.2.62","3.2.61","3.2.60","3.2.59","3.2.58","3.2.57","3.2.56","3.2.55","3.2.54","3.2.53","3.2.51","3.2.50","3.2.49","3.2.48","3.2.47","3.2.46","3.2.45","3.2.44","3.2.38","3.2.43","3.2.42","3.2.40","3.2.37","3.2.36","3.2.34","3.2.33","3.2.32","3.2.31","3.2.29","3.2.28","3.2.27","3.2.26","3.2.25","3.2.24","3.2.22","3.2.21","3.2.19","3.2.17","3.2.16","3.2.15","3.2.14","3.2.13","%npm_package_version%","3.2.10","3.2.9","3.2.8","3.2.7","3.2.6","3.2.5","3.2.4","3.2.3","3.2.2","3.2.1","3.1.96","3.1.95","3.1.94","3.1.93","3.1.92","3.1.91","3.1.90","3.1.89","3.1.88","3.1.87","3.1.86","3.1.85","3.1.84","3.1.83","3.1.82","3.1.81","3.1.80","3.1.79","3.1.78","3.1.77","3.1.76","3.1.75","3.1.74","3.1.73","3.1.72","3.1.71","3.1.70","3.1.69","3.1.68","3.1.67","3.1.66","3.1.65","3.1.64","3.1.63","3.1.62","3.1.61","3.1.60","3.1.59","3.1.58","3.1.57","3.1.56","3.1.55","3.1.54","3.1.53","3.1.52","3.1.51","3.1.50","3.1.49","3.1.48","3.1.47","3.1.46","3.1.45","3.1.44","3.1.43","3.1.42","3.1.41","3.1.40","3.1.39","3.1.38","3.1.37","3.1.36","3.1.35","3.1.34","3.1.33","3.1.32","3.1.31","3.1.30","3.1.29","3.1.28","3.1.27","3.1.26","3.1.25","3.1.24","3.1.23","3.1.22","3.1.21","3.1.20","3.1.19","3.1.18","3.1.17","3.1.16","3.1.15","3.1.13","3.1.12","3.1.11","3.1.10","3.1.9","3.1.8","3.1.7","3.1.6","3.1.5","3.1.4","3.0.35","3.0.34","3.0.33","3.0.32","3.0.31","3.0.30","3.0.29","3.0.28","3.0.27","3.0.26","3.0.24","3.0.23","3.0.22","3.0.21","3.0.20","3.0.19","3.0.18","3.0.17","3.0.16","3.0.15","3.0.14","3.0.13","3.0.12","3.0.11","3.0.10","3.0.9","3.0.8","3.0.7","3.0.6","3.0.5","3.0.4","3.0.3","3.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55886.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}