CVE-2026-55886: jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set()

June 18, 2026 (updated July 31, 2026)

Jodit.modules.Helpers.set(chain, value, obj) walks the dot-separated chain, creating and following each path segment, without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype (prototype pollution).

References

github.com/advisories/GHSA-vpmm-x3fm-qr5c
github.com/xdan/jodit/security/advisories/GHSA-vpmm-x3fm-qr5c
nvd.nist.gov/vuln/detail/CVE-2026-55886

Code Behaviors & Features

Detect and mitigate CVE-2026-55886 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →