CVE-2026-54756: Jodit has prototype pollution via Jodit.configure() / ConfigMerge

July 31, 2026

Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype (prototype pollution).

References

github.com/advisories/GHSA-5957-5c94-3v7w
github.com/xdan/jodit/commit/d298397bc993793b17145806c15f7dae53f90104
github.com/xdan/jodit/releases/tag/4.12.18
github.com/xdan/jodit/security/advisories/GHSA-5957-5c94-3v7w
nvd.nist.gov/vuln/detail/CVE-2026-54756

Code Behaviors & Features

Detect and mitigate CVE-2026-54756 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →