Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jodit | npm | <= 4.12.30 | 4.12.31 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the sanitizeHTMLElement function located in src/core/helpers/html/safe-html.ts. The root cause is an incomplete sanitization of href attributes containing javascript: URLs. The original code used a simple, case-sensitive indexOf check that was insufficient to prevent several obfuscation methods. The provided patch confirms this by replacing the weak check with a call to a more robust function, isDangerousUrl, which normalizes the URL by removing control characters and converting it to lowercase before checking for dangerous schemes. This change effectively mitigates the XSS vulnerability. The sanitizeHTMLElement function is the direct entry point for this vulnerability, as it is responsible for processing the HTML and failing to properly sanitize the malicious href attribute.
sanitizeHTMLElementsrc/core/helpers/html/safe-html.ts