CVE-2026-65841: Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

A <script> element placed directly inside an <svg> (or MathML) container was not removed by Jodit’s clean-html sanitizer.

The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names — an SVG script reports "script", not "SCRIPT" — so the default denyTags list (which includes script) did not match it. The script therefore survived in the editor value and serialized output, where it could execute when the content was loaded back into a page or editor.