Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: jsondiffpatch 0.7.6 Clear all filters
TI-2026-07606 CVE-2026-8657 · GHSA-j4fx-xxwh-2485

Prototype pollution in jsondiffpatch

Priority HIGH 77

Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00378 Published 2026-05-16 Fixed in 0.7.6 CWE-1321
TI-2026-07605 CVE-2026-8656 · GHSA-2f3m-j83v-344c

Cross-site scripting in jsondiffpatch

Priority MEDIUM 56

Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper sanitization of JSON values and property names.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00191 Published 2026-05-16 Fixed in 0.7.6 CWE-79