CVE-2026-62324: Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

jodit’s sanitizeHTMLElement neutralizes a javascript: href using a bare href.trim().indexOf('javascript') === 0 check. This omits the normalization jodit applies to every other URL attribute: isDangerousUrl strips control bytes with value.replace(/[\u0000-\u0020]+/g, '') and lowercases the value before testing the scheme. Because the href check does neither, it is bypassed by three obfuscation classes, all confirmed firing on click against the shipped 4.12.30 build:

1. Case variants: JAVASCRIPT:, Javascript:, jaVaScRiPt: (the check is case-sensitive).
2. A leading C0 control byte, e.g. a \x01 prefix before lowercase javascript: (trim() does not remove bytes in the \x00-\x08 / \x0e-\x1f range, but the browser strips a leading control byte before resolving the scheme).
3. An embedded tab or newline inside the scheme, e.g. java\tscript: or java\nscript: (the browser strips tab/newline from a URL, but indexOf('javascript') sees the broken word and does not match).

The dangerous href survives editor.value = assignment and the on-change LazyWalker, persisting in the stored editor value. A victim who clicks the link in any consumer that renders the stored value (readonly editor, server-rendered page, innerHTML consumer) runs attacker-controlled JS in that page’s origin.