CVE-2026-122234 in jsondiffpatch
Summary
by MITRE • 11/04/2026
jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in jsondiffpatch prior to version 0.7.7 represents a significant security flaw within the library used for generating and applying JSON patches. This specific issue manifests as a cross-site scripting (XSS) attack vector, which arises from insufficient input validation and output encoding when processing delta objects. The core technical failure lies in how the library handles array-move operations during the formatting process. When an attacker supplies a maliciously crafted delta that includes an unescaped destination index for moving elements within an array structure, the resulting HTML output generated by specific formatter methods fails to properly sanitize this input data. This lack of sanitization allows arbitrary markup and script tags to be embedded directly into the rendered page context without being escaped or neutralized by the underlying processing logic.
The operational impact of this vulnerability is severe for any application that relies on jsondiffpatch to display patch deltas in a web browser environment, particularly when utilizing the formatters.html.format() or formatters.annotated.format() methods. These functions are designed to convert JSON delta structures into human-readable HTML representations. If an attacker can control the content of the delta passed to these functions, they can inject executable JavaScript code that runs within the security context of the victim application's origin. This capability enables a range of malicious activities including session hijacking through cookie theft, credential harvesting via fake login forms injected into the page, defacement of the user interface, or redirection of users to phishing sites. Because the script executes with the privileges of the trusted site, it bypasses same-origin policy protections that would otherwise limit the scope of potential damage from external sources.
From a classification perspective, this vulnerability aligns closely with CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves reflected or stored input where user-supplied data is inserted into HTML output without adequate validation. In the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Client-side Code Injection and potentially Credential Access if session tokens are targeted. Attackers would typically need to trick a victim into processing a maliciously constructed delta object, either through direct interaction or by exploiting other vulnerabilities that allow injection of such data structures into the application's workflow.
Mitigation strategies for this vulnerability primarily involve upgrading the jsondiffpatch library to version 0.7.7 or later where these issues have been addressed. Developers should ensure that their build pipelines enforce dependency updates and regularly scan for known vulnerable versions in third-party libraries. In scenarios where immediate patching is not feasible, application-level defenses such as strict Content Security Policy (CSP) headers can help mitigate the impact by restricting script execution sources. Additionally, implementing robust input validation on any data entering the delta processing pipeline ensures that unexpected or malformed structures are rejected before they reach the formatting stage. Regular security audits and static analysis tools configured to detect XSS patterns in template rendering logic further reduce the risk of similar vulnerabilities emerging from other parts of the codebase.