jodit 4.12.25 → 4.12.26

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.25
+ * Version: v4.12.26
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.25
+ * Version: v4.12.26
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.25
+ * Version: v4.12.26
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.25
+ * Version: v4.12.26
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.25
+ * Version: v4.12.26
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.25
+ * Version: v4.12.26
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.25
+ * Version: v4.12.26
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.25
+ * Version: v4.12.26
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.25
+ * Version: v4.12.26
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.12.25";
+export const APP_VERSION = "4.12.26";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/core/helpers/utils/config-proto.js

@@ -9,16 +9,8 @@ import { isString } from "../checker/is-string.js";
 import { isVoid } from "../checker/is-void.js";
 import { Config } from "../../../config.js";
 import { isAtom } from "./extend.js";
+import { isUnsafeProtoKey } from "./is-unsafe-proto-key.js";
 import { keys } from "./utils.js";
-/**
- * Keys that must never be copied from a (potentially untrusted) config object —
- * assigning them during a recursive merge can reach and mutate
- * `Object.prototype` (prototype pollution, CWE-1321).
- */
-const UNSAFE_PROTO_KEYS = ['__proto__', 'constructor', 'prototype'];
-function isUnsafeProtoKey(key) {
-    return UNSAFE_PROTO_KEYS.indexOf(key) !== -1;
-}
 /**
  * @example
  * ```js

package/esm/core/helpers/utils/index.d.ts

@@ -24,6 +24,7 @@ export * from "./extend";
 export * from "./get";
 export * from "./get-class-name";
 export * from "./human-size-to-bytes";
+export * from "./is-unsafe-proto-key";
 export * from "./mark-deprecated";
 export * from "./parse-query";
 export * from "./print";

package/esm/core/helpers/utils/index.js

@@ -24,6 +24,7 @@ export * from "./extend.js";
 export * from "./get.js";
 export * from "./get-class-name.js";
 export * from "./human-size-to-bytes.js";
+export * from "./is-unsafe-proto-key.js";
 export * from "./mark-deprecated.js";
 export * from "./parse-query.js";
 export * from "./print.js";

package/esm/core/helpers/utils/is-unsafe-proto-key.d.ts

@@ -0,0 +1,18 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * @module helpers/utils
+ */
+/**
+ * Keys that must never be written from a (potentially untrusted) source —
+ * assigning them while walking/merging an object can reach and mutate
+ * `Object.prototype` (prototype pollution, CWE-1321).
+ */
+export declare const UNSAFE_PROTO_KEYS: string[];
+/**
+ * Check whether a key can be used to pollute the prototype chain.
+ */
+export declare function isUnsafeProtoKey(key: string): boolean;

package/esm/core/helpers/utils/is-unsafe-proto-key.js

@@ -0,0 +1,20 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * @module helpers/utils
+ */
+/**
+ * Keys that must never be written from a (potentially untrusted) source —
+ * assigning them while walking/merging an object can reach and mutate
+ * `Object.prototype` (prototype pollution, CWE-1321).
+ */
+export const UNSAFE_PROTO_KEYS = ['__proto__', 'constructor', 'prototype'];
+/**
+ * Check whether a key can be used to pollute the prototype chain.
+ */
+export function isUnsafeProtoKey(key) {
+    return UNSAFE_PROTO_KEYS.indexOf(key) !== -1;
+}

package/esm/core/helpers/utils/set.js

@@ -7,6 +7,7 @@ import { isArray } from "../checker/is-array.js";
 import { isNumeric } from "../checker/is-numeric.js";
 import { isPlainObject } from "../checker/is-plain-object.js";
 import { isString } from "../checker/is-string.js";
+import { isUnsafeProtoKey } from "./is-unsafe-proto-key.js";
 /**
  * Safe access in tree object
  *
@@ -25,6 +26,9 @@ export function set(chain, value, obj) {
         return;
     }
     const parts = chain.split('.');
+    if (parts.some(isUnsafeProtoKey)) {
+        return;
+    }
     let result = obj, key = parts[0];
     for (let i = 0; i < parts.length - 1; i += 1) {
         key = parts[i];

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "jodit",
-	"version": "4.12.25",
+	"version": "4.12.26",
 	"description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
 	"main": "esm/index.js",
 	"types": "types/index.d.ts",

package/types/core/helpers/utils/index.d.ts

@@ -24,6 +24,7 @@ export * from "./extend";
 export * from "./get";
 export * from "./get-class-name";
 export * from "./human-size-to-bytes";
+export * from "./is-unsafe-proto-key";
 export * from "./mark-deprecated";
 export * from "./parse-query";
 export * from "./print";

package/types/core/helpers/utils/is-unsafe-proto-key.d.ts

@@ -0,0 +1,18 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * @module helpers/utils
+ */
+/**
+ * Keys that must never be written from a (potentially untrusted) source —
+ * assigning them while walking/merging an object can reach and mutate
+ * `Object.prototype` (prototype pollution, CWE-1321).
+ */
+export declare const UNSAFE_PROTO_KEYS: string[];
+/**
+ * Check whether a key can be used to pollute the prototype chain.
+ */
+export declare function isUnsafeProtoKey(key: string): boolean;