LOW 2.3 NVD
CVE-2026-122234
jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination
jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.
References
- https://github.com/benjamine/jsondiffpatch/commit/c6b2d97b34bc2356c816d8dd0f8b1c8af16bb6af
- https://github.com/benjamine/jsondiffpatch/security/advisories/GHSA-jhmf-rq89-q58p
- https://www.vulncheck.com/advisories/jsondiffpatch-before-0.7.7-xss-via-array-move-destina
This low severity vulnerability with a CVSS score of 2.3 was published on 2026-11-04 via NVD.
vulnfeed aggregates 16578 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.