Skip to content
Sign in
6.1 Medium

CVE-2026-8656 Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated…

Description

Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper sanitization of JSON values and property names. If an application compares untrusted JSON/object data and renders annotated formatter output in the DOM, attacker-controlled HTML can be interpreted by the browser, resulting in XSS.

Affected products and versions

Product Affected versions Fixed in
jsondiffpatch 0.7 earliest → < 0.7.6 0.7.6

Other CVEs of jsondiffpatch

The 3 CVEs of jsondiffpatch →
CVE-2026-8657 Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch()… 8.2 High CVE-2025-9910 Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via… 4.7 Medium
Track this CVE