jsondiffpatch vulnerabilities

jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.

Prototype Pollution vulnerability in jsondiffpatch before version 0.7.6 allows an attacker to modify Object.prototype by supplying crafted delta or JSON Patch documents. The issue stems from unrestricted access to special properties like __proto__ or constructor.prototype in the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs.

jsondiffpatch packages before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads are used as the diff source and the result is rendered with the built-in HTML formatter on a private website.