Skip to content

4.12.26

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Jun 19:07
· 5 commits to main since this release
4.12.26
abe7f7c

🐛 Bug Fix

  • Security / Helpers (prototype pollution): Jodit.modules.Helpers.set(chain, value, obj) walked the dot-separated chain and created/followed each segment without filtering prototype-mutating keys, so a chain such as __proto__.polluted (e.g. set('__proto__.polluted', 'yes', {})) could reach and mutate Object.prototype (CWE-1321). set now bails out when any segment is __proto__, constructor, or prototype, reusing the same guard added for Jodit.configure() in 4.12.18. Responsibly reported by Junming Wu.
Assets 2
Loading