CVE-2023-42399

MediumCVSS 6.1

Published: 19/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability was found in Jodit Editor version 4.0.0-beta.86. The flaw allows a remote attacker to inject malicious JavaScript code through the rich text editor component.

Risk Assessment

An attacker can steal sensitive information such as session cookies or user credentials from users interacting with the editor. This could lead to account takeover or exposure of confidential data.

Recommendation

Immediately update the Jodit Editor library to the latest stable version containing security fixes. Additionally, consider implementing Content Security Policy (CSP) headers in your application.

Original NVD description (English source)

Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component.