CVE-2026-122234
MediumCVSS 4.7Summary
jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.
Risk Assessment
Arbitrary JavaScript execution in the victim application's context may lead to session or data theft. The risk affects applications rendering untrusted jsondiffpatch deltas.
Recommendation
Update jsondiffpatch to version 0.7.7 or later. Do not render untrusted deltas without proper output escaping.
Other vulnerabilities in jsondiffpatch
See all- CVE-2026-8657High
Prototype Pollution vulnerability in jsondiffpatch before version 0.7.6 allows an attacker to modify Object.prototype by supplying crafted delta or JSON Patch documents. The issue stems from unrestricted access to special properties like __proto__ or constructor.prototype in the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs.
- CVE-2025-9910Medium
jsondiffpatch packages before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads are used as the diff source and the result is rendered with the built-in HTML formatter on a private website.
Original NVD description (English source)
jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS