GHSA-rxcw-mc6f-6hr3 Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

• npm jodit: < 4.12.28 → fixed in 4.12.28

Summary jodit's built-in `clean-html` sanitizer can be bypassed by a MathML/`` carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value. When an application supplies attacker-influenced HTML to the editor's value-set or insertion paths, the sanitized output still contains a live `` (or another non-`onerror` handler such as `onfocus`). A consumer that renders that output (`element.innerHTML = editor.value`) executes the handler with no user interaction. This is a stored cross-site scripting vulnerability, confirmed live on the shipped `es2021/jodit.min.js` for 4.12.25 and the latest 4.12.27 (in Chromium via a client-side `innerHTML` consumer, and in Firefox via server-rendered / document-context output; see the cross-browser note under Proof of concept). Details The bypass exploits the order in which `clean-html` parses, walks, and re-serializes the value. 1. On the value-set path, the `clean-html` plugin handles `:beforeSetNativeEditorValue` (`src/plugins/clean-html/clean-html.ts:116`), parsing the value into an inert document: `sandBox.innerHTML = data.value`. 2. In that parse, the source nesting `math > mtext > table > mglyph > style` triggers MathML text-integration-point and foster-parenting rules: the `` is parsed as text inside `` (rawtext), not as an element. The `'; // editor.value (the sanitized, stored output) now contains a live handler, and it persists (onload, like any // non-onerror handler, is not removed by jodit's on-change cleaner): // // // document.getElementById('view').innerHTML = editor.value; // a consumer renders the saved value // -> the 1x1 gif loads, onload fires alert(document.domain), no interaction ``` Cross-browser: `editor.value` carries the hoisted live `` in both Blink and Gecko, but the consumer's parse mode decides execution. Chromium fires it under both client-side `element.innerHTML` and document parsing; Firefox fires it only under document parsing (server-side rendering, `document.write`, ``), because under `innerHTML` Gecko leaves the `` in the MathML namespace, …