Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
1.3

jsondiffpatch could let attackers run code

CVE-2025-9910 · published 14 days ago
Summary

The jsondiffpatch library used in several npm packages (beneidel/jsondiffpatch, jsondiffpatch, @rootio/jsondiffpatch) has a flaw that could let a malicious user execute code on your system. This could compromise your applications or data. Update to the latest patched version of the affected packages as soon as possible.

What to do
  • Update beneidel jsondiffpatch to version 0.7.2.
  • Update jsondiffpatch to version 0.6.0-aikido.3.
  • Update rootio @rootio/jsondiffpatch to version 0.6.0-root.io.3.
Affected software
Ecosystem VendorProductAffected versions
npm beneidel jsondiffpatch < 0.7.2
Fix: upgrade to 0.7.2
Root:npm – jsondiffpatch < 0.6.0-aikido.3
Fix: upgrade to 0.6.0-aikido.3
Root:npm rootio @rootio/jsondiffpatch < 0.6.0-root.io.3
Fix: upgrade to 0.6.0-root.io.3
Original advisory text
CVE-2025-9910 in jsondiffpatch - Patched by Root
Root has patched CVE-2025-9910 in the jsondiffpatch package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
1.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published5 Oct 2026
Updated15 Oct 2026
First seen6 Mar 2026
Sources
GHSA-33vc-wfww-vjfv · GHSA
CVE-2025-9910 · NVD
ROOT-APP-NPM-CVE-2025-9910 · OSV
Track software like this
Free during beta