CVE-2026-29036 in cJSON
Summary
by MITRE • 08/12/2026
cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability resides in the cJSON library's handling of JSON Pointer escape sequences within the decode_pointer_inplace() function located in cJSON_Utils.c. This flaw affects versions 1.5.0 through 1.7.19 and represents a critical security issue that can be exploited by unauthenticated attackers to manipulate JSON Patch operations. The core problem stems from improper parsing of the ~0 and ~1 escape sequences defined in RFC 6902, which are used to represent forward slashes and tilde characters respectively within JSON Pointer paths. When applications process JSON Patch operations using the cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() functions, the library fails to correctly resolve these escape sequences, leading to incorrect object key targeting during patch application.
This vulnerability falls under CWE-1287, which specifically addresses improperly resolved name or reference issues in software components. The flaw enables attackers to craft malicious JSON Patch requests that appear legitimate but actually target different data elements than intended. When an attacker submits a patch operation containing crafted escape sequences, the library incorrectly interprets the patch path, causing modifications to occur at unintended locations within the JSON structure. This misinterpretation can result in silent data corruption or unauthorized key deletion, as the patch operations are processed against the wrong object keys rather than those specified by the attacker's intent.
The operational impact of this vulnerability extends beyond simple data manipulation, potentially compromising authorization controls within applications that depend on JSON Patch for access-controlled modifications. Applications relying on cJSON for processing user-submitted patches may experience unauthorized data changes that bypass normal security boundaries. The attack can be executed without authentication requirements, making it particularly dangerous in environments where JSON Patch operations are used for administrative functions or user data modification. This vulnerability essentially creates a pathway for attackers to silently modify application data structures, potentially leading to privilege escalation, data loss, or system compromise depending on the application's architecture and data sensitivity.
Mitigation strategies should focus on immediate version upgrades to cJSON 1.7.20 or later, which contain fixes for this specific vulnerability. Organizations should also implement input validation and sanitization measures for JSON Patch operations, including thorough review of patch paths before processing. Additional defensive measures include monitoring for unusual JSON Patch patterns, implementing rate limiting on patch operations, and conducting regular security assessments of applications that utilize cJSON for JSON processing. The vulnerability demonstrates the importance of proper escape sequence handling in parsing libraries and underscores the need for comprehensive testing of edge cases in JSON processing functions. Security teams should also consider implementing automated scanning tools to identify applications using vulnerable cJSON versions and ensure proper patch deployment across all affected systems.