Read the docs
TI-2026-85207 Aliases CVE-2026-122234GHSA-36c7-f344-vj2m

Cross-site scripting in jsondiffpatch HTML formatters via array-move index

Priority LOW 11CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

jsondiffpatch before 0.7.7 contains a cross-site scripting flaw in its HTML formatters, where an array-move destination index is written into output without escaping. An attacker who controls a delta passed to formatters.html.format() or formatters.annotated.format() can inject markup (CWE-79) that runs script in the application's origin when the output is rendered. The CVSS 4.0 vector requires user interaction and gives a base score of 2.3 (LOW).

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.

Why it matters now

EPSS 0.00179 7th percentileScored 2026-11-07
Fix Fixed jsondiffpatch (benjamine): 0.7.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
benjaminejsondiffpatchbefore 0.7.70.7.7Patch availableCNA
  • jsondiffpatch Vendorbenjamine Affected before 0.7.7 Fixed in 0.7.7 Patch available CNA

Remediation

Upgrade jsondiffpatch to version 0.7.7 or later, which is the fixed version listed for benjamine jsondiffpatch.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA jsondiffpatch (benjamine) Fixed in 0.7.7

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122234
  2. 2026-11-04 Alias added: GHSA-36c7-f344-vj2m

References

Patch 1

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences