CVE-2025-9910
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
jsondiffpatch packages before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads are used as the diff source and the result is rendered with the built-in HTML formatter on a private website.
Risk Assessment
If an application renders diffs from untrusted sources using the built-in HTML formatter, an attacker can execute arbitrary code in the user's browser. This can lead to session or data theft.
Recommendation
Update jsondiffpatch to version 0.7.2 or later. Avoid rendering untrusted data through HtmlFormatter or apply additional output sanitization.
Other vulnerabilities in jsondiffpatch
See all- CVE-2026-122234Medium
jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.
- CVE-2026-8657High
Prototype Pollution vulnerability in jsondiffpatch before version 0.7.6 allows an attacker to modify Object.prototype by supplying crafted delta or JSON Patch documents. The issue stems from unrestricted access to special properties like __proto__ or constructor.prototype in the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs.
Original NVD description (English source)
Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS