build(deps): bump jodit from 4.12.26 to 4.12.27

[dependabot]

Bumps jodit from 4.12.26 to 4.12.27.

Changelog

Sourced from jodit's changelog.

Changelog

Tags:

• 💥 [Breaking Change]
• 🚀 [New Feature]
• 🐛 [Bug Fix]
• 📝 [Documentation]
• 🏠 [Internal]
• 💅 [Polish]

4.12.28

🐛 Bug Fix

• Security / clean-html (mutation XSS, CWE-79): the HTML sanitizer (safeHTML) walked the parsed value as elements, but a handler smuggled as <style> rawtext inside a MathML/SVG foreign-content carrier (e.g. math > mtext > table > mglyph > style hiding an <img onload=…>) was never an element during that walk. A later serialize-reparse then hoisted the <img> out of <style> into a live HTML node with its on* handler intact, so an application that re-rendered editor.value could execute attacker script with no user interaction — a stored XSS in the default config affecting all 3.x/4.x through 4.12.27. The fix drops the smuggled HTML at the source: any HTML-namespace element the parser placed inside <math>/<svg> outside an integration point (foreignObject/annotation-xml/desc/title) is removed before the walk, which also covers carriers nested one level deeper without a re-parse loop. Legitimate MathML/SVG content and top-level <style>/<script> are preserved. Responsibly reported by Younghun Ko of AhnLab (@​koyokr) (GHSA-rxcw-mc6f-6hr3).

Commits

• ada2092 New version 4.12.27 Read more https://github.com/xdan/jodit/blob/main/CHANGEL...
• 422dbf1 Merge branch 'main' of github.com:xdan/jodit
• c8a0b14 fix(security): enhance HTML sanitizer to prevent stored XSS vulnerabilities
• e25e487 chore: update statoscope reference stats
• 66e41db chore(deps-dev): bump esbuild and tsx (#1371)
• See full diff in compare view