Skip to content
Sign in
4.7 Medium

CVE-2025-9910 Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via…

Description

Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.

Affected products and versions

Product Affected versions Fixed in
jsondiffpatch 0.7 earliest → < 0.7.2 0.7.2
org.webjars.npm:jsondiffpatch Versions not published
org.webjars.bower:jsondiffpatch Versions not published

Other CVEs of jsondiffpatch

The 3 CVEs of jsondiffpatch →
CVE-2026-8657 Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch()… 8.2 High CVE-2026-8656 Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated… 6.1 Medium
Track this CVE