Listen to this Post
Intro
CVE-2026-58263 is a stored Cross-Site Scripting (XSS) vulnerability in the Jodit WYSIWYG editor. The core issue lies in a bypass of the built-in `clean-html` sanitizer. The bypass exploits a specific sequence of HTML elements: math > mtext > table > mglyph > style. When this structure is assigned to the editor’s `value` property, it triggers a series of parsing and sanitization steps that allow a dangerous event handler, such as onload, to survive.
During the initial sanitization pass, the HTML is parsed into an inert document. In this parse, the `` tag is treated as raw text inside the `