jodit 4.13.3 → 4.13.6

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.13.3
+ * Version: v4.13.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.13.3
+ * Version: v4.13.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.13.3
+ * Version: v4.13.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.13.3
+ * Version: v4.13.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.13.3
+ * Version: v4.13.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.13.3
+ * Version: v4.13.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.13.3
+ * Version: v4.13.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.13.3
+ * Version: v4.13.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.13.3
+ * Version: v4.13.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.13.3";
+export const APP_VERSION = "4.13.6";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/core/helpers/html/safe-html.js

@@ -51,7 +51,7 @@ export function safeHTML(box, options) {
     // markup into a live node.
     const foreign = box.querySelectorAll('math *, svg *');
     for (let i = 0; i < foreign.length; i++) {
-        if (foreign[i].isConnected && isSmuggledForeignHtml(foreign[i])) {
+        if (box.contains(foreign[i]) && isSmuggledForeignHtml(foreign[i])) {
             Dom.safeRemove(foreign[i]);
         }
     }
@@ -160,7 +160,8 @@ export function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } =
     // scheme (e.g. `java\tscript:`) — all of which the browser still resolves to
     // `javascript:` on click. See GHSA-j839-gqq4-gf9j.
     if (safeJavaScriptLink && href && isDangerousUrl(href, tagName)) {
-        attr(elm, 'href', location.protocol + '//' + href);
+        const protocol = typeof location !== 'undefined' ? location.protocol : 'http:';
+        attr(elm, 'href', protocol + '//' + href);
         effected = true;
     }
     if (safeJavaScriptLink) {

package/esm/modules/toolbar/button/button.js

@@ -126,7 +126,8 @@ let ToolbarButton = class ToolbarButton extends UIButton {
         button.classList.remove(cn);
         button.classList.add(cn + '__button');
         Object.defineProperty(button, 'component', {
-            value: this
+            value: this,
+            configurable: true
         });
         container.appendChild(button);
         const trigger = this.j.c.fromHTML(`<span role="button" aria-haspopup="true" aria-expanded="false" class="${cn}__trigger">${Icon.get('chevron')}</span>`);

package/esm/plugins/clean-html/helpers/visitor/filters/try-remove-node.js

@@ -23,16 +23,23 @@ export function tryRemoveNode(jodit, nodeElm, hadEffect, allowTags, denyTags, cu
  */
 function isRemovableNode(jodit, node, current, allow, deny) {
     if (!Dom.isText(node)) {
-        if (allow && !allow[node.nodeName]) {
+        // The allow/deny hashes are keyed by upper-cased tag name. HTML
+        // `nodeName` is already upper-case, but foreign (SVG/MathML) elements
+        // keep their original case — an SVG `<script>` reports `"script"`, so a
+        // case-sensitive lookup let it slip past `denyTags` and execute. Normalise
+        // to upper case so namespace can't bypass the filter. See
+        // GHSA-45qg-252v-3f7p.
+        const name = node.nodeName.toUpperCase();
+        if (allow && !allow[name]) {
             return true;
         }
         // A YouTube/Vimeo player inserted through the Video button is trusted
         // editor content, so keep it even though `iframe` is denied by default
         // — otherwise the embed is stripped ~300ms after insertion (#1381).
         // Arbitrary/bare iframes stay denied.
-        const isTrustedEmbed = node.nodeName === 'IFRAME' &&
+        const isTrustedEmbed = name === 'IFRAME' &&
             isAllowedMediaEmbed(attr(node, 'src') || '');
-        if (!allow && deny && deny[node.nodeName] && !isTrustedEmbed) {
+        if (!allow && deny && deny[name] && !isTrustedEmbed) {
             return true;
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "jodit",
-	"version": "4.13.3",
+	"version": "4.13.6",
 	"description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
 	"main": "esm/index.js",
 	"types": "types/index.d.ts",