Unexpected Cloudflare calls by jodit.min.js

[miltonh26]

Jodit Version

4.9.16 Pro

Browser

Chrome, Firefox

Operating System

Linux

Is React App?

No

Reproduced on xdsoft.net?

No

Code to reproduce

Both jodit.min.js and jodit.fat.min.js are making unexpected Cloudflare calls from the JS files which have been downloaded and run locally.

Both versions 4.7.6 and 4.9.16 have the same behavior currently.

My code is applied consistently for different pages using Jodit, yet I am seeing inconsistent loading of the Jodit editor. When the editor loads properly and Jodit runs OK it makes Cloudflare calls, as-in:

https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/themes/prism.min.js
https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/themes/prism.min.css
https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/autoloader/prism-autoloader.min.js

When the Cloudflare calls are not successful, Jodit fails and errors out.

It does so silently without any error messages to help track the issue down. The error screenshot I uploaded is the result of Jodit not being properly initialized in my code, resulting in the errors shown.

To be perfectly clear, the application is running the same webapp and Jodit acts differently. Most pages work correctly, but then others don't, with no explanation and the same code.

My development machine and production server have been working correctly for months, yet suddenly it has this intermittent error causing Jodit to break.

Expected behavior

Since I pulled down Jodit files down locally, I would not expect Jodit or plugins to make calls outside the application for needed files. They should all be available locally.

Jodit needs to run consistently and be stable, and not make external calls from the locally downloaded and executed files.

Actual behavior

Inconsistent Jodit usage.

[xdan]

What you’re seeing isn’t Jodit “phoning home” for core editor code — it’s the Paste Code plugin’s syntax-highlighting dependency being loaded from cdnjs (Cloudflare) by default.

In Jodit’s docs for the paste-code plugin, the default highlightLib is explicitly configured to load Prism from cdnjs:

• JS defaults include Prism + the autoloader:

  • https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/prism.min.js
  • https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/autoloader/prism-autoloader.min.js

• CSS default:

https://xdsoft.net/jodit/pro/docs/plugin/paste-code/

• https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/themes/prism.min.css
• And langUrl() points at cdnjs for per-language components too.

So even if you host jodit.min.js / jodit.fat.min.js locally, the paste-code plugin will still inject <script>/<link> tags to cdnjs unless you override that config.

Why it seems “inconsistent” across pages

It typically depends on whether the paste-code plugin gets triggered on that page/session, for example:

• that page enables the Paste Code button / plugin
• the page content includes code blocks that cause highlighting to run
• the plugin lazily loads Prism only when it needs it

So: same app, but different pages/content → different moments when Prism loading is attempted → when cdnjs fails (blocked, CSP, adblock, transient network/DNS), the plugin’s load can fail and may cascade into a broken init if the error isn’t surfaced.

Fix: point pasteCode.highlightLib to your local Prism files

Download Prism + the theme + the autoloader (and any language components you need) and serve them from your app, then configure:

Jodit.make('#editor', {
  pasteCode: {
    highlightLib: {
      // (optional) keep this if you rely on Prism.manual behavior
      beforeLibLoad() {
        window.Prism = window.Prism || {};
        window.Prism.manual = true;
      },

      js: [
        '/assets/prism/prism.min.js',
        '/assets/prism/plugins/autoloader/prism-autoloader.min.js'
      ],
      css: [
        '/assets/prism/themes/prism.min.css'
      ],

      // When a language isn’t loaded yet, Jodit calls this:
      langUrl: (lang) => `/assets/prism/components/prism-${lang}.min.js`,

      // Keep the default logic or customize:
      isLangLoaded(lang) {
        if (lang === 'html') return true;
        return typeof Prism !== 'undefined' ? Boolean(Prism.languages[lang]) : false;
      }
    }
  }
});

That directly replaces the cdnjs URLs shown in the official paste-code docs.

Extra note (Prism autoloader)

Depending on how Prism autoloader is configured, you may also need to set its languages path after load (Prism’s own setting), but the langUrl override above is the key piece on the Jodit side.

Fix: if you don’t use Paste Code, disable the plugin

If you don’t need code pasting/highlighting at all, disable it so it never tries to load Prism:

Jodit.make('#editor', {
  disablePlugins: ['pasteCode']
});

(Plugin name can vary slightly by build/edition, but pasteCode is the one referenced by the paste-code docs. )

Stabilize debugging (so it doesn’t “fail silently”)

Two practical steps that usually make this kind of issue obvious immediately:

1. Open DevTools → Network and filter for prism / cdnjs and confirm which page triggers the load.
2. Add a strict CSP (script-src 'self') temporarily — it will force a clear, logged CSP violation when anything tries to hit cdnjs.

---

If you paste your Jodit init options (especially buttons, extraPlugins, disablePlugins, and anything related to pasteCode) I can tell you exactly which option is enabling the behavior and the cleanest way to make it 100% offline/self-hosted.

[miltonh26]

Thanks for the reply and I truly appreciate the in depth explanation.

The app's initialization code is attached, as requested.

There is another issue where the cursor is jumping home whenever the change event is called when the jodit instance is refreshed with updated innerHTML. See "// HERE".

I am not certain if this is related or not, doesn't seem like it. If not, I can log another bug.

Jodit WYSIWYG Init_20260226 - submitted for bug 1330.txt

[SergioChan]

Thanks for the detailed report — I started digging into this. In the current open-source source tree I can’t find any Prism CDN/autoloader URLs referenced by the runtime editor code (only example/demo pages include Prism for syntax highlighting examples), so this may depend on a specific integration path or a Pro-only bundle path.\n\nCould you share a minimal reproducible HTML page that includes only your local / and editor init config (especially any , plugins, or custom script loaders)? If you can also attach a Network tab screenshot filtered to and identify which script initiates the request (Initiator column), that should let us pinpoint the exact code path quickly.

[SergioChan]

Quick correction to my previous comment (shell ate a few code-formatted tokens):

Could you share a minimal reproducible HTML page that includes only your local jodit.min.js + jodit.min.css and editor init config (especially any sourceEditor* options, plugins, or custom script loaders)?

Also, if possible, attach a Network tab capture filtered to prism and include the request Initiator value for one of those CDN calls.