THREAT OPS › Threat News › [GHSA] GHSA-j839-gqq4-gf9j (medium) — Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
[GHSA] GHSA-j839-gqq4-gf9j (medium) — Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
GHSA-j839-gqq4-gf9j Severity: medium CVE: CVE-2026-62324
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
### Summary
jodit's `sanitizeHTMLElement` neutralizes a `javascript:` `href` using a bare `href.trim().indexOf('javascript') === 0` check. This omits the normalization jodit applies to every other URL attribute: `isDangerousUrl` st
MITRE ATT&CK techniques
- JavaScriptT1059.007
Indicators of compromise
- CVE-2026-62324cve
- https://javascript:...`url
- https://...`url
Original source: https://github.com/advisories/GHSA-j839-gqq4-gf9j