Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

jsondiffpatch may run malicious code in web pages

CVE-2026-122234 · published today
Summary

The jsondiffpatch library (versions before 0.7.7) can insert unsafe code when it builds HTML from a specially crafted change description. This could let an attacker run scripts in the same browser session as your users, potentially stealing data or taking actions on their behalf. Update to version 0.7.7 or later, or avoid using the HTML formatting functions with untrusted input.

What to do
  • Update benjamine jsondiffpatch to version 0.7.7 or later.
Affected software
VendorProductAffected versions
benjamine jsondiffpatch < 0.7.7
Original advisory text
jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters
jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.3 Low
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Sources
CVE-2026-122234 · NVD
CVE-2026-122234 · MITRE
Track software like this
Free during beta