Most recent entries from all

EUVD-2026-252474

fkie_cve-2025-9910

Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.

GHSA-33vc-wfww-vjfv — jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin

Affected: npm: jsondiffpatch

### Vulnerability in jsondiffpatch

Versions of `jsondiffpatch` prior to `0.7.2` are vulnerable to Cross-site Scripting (XSS) in the `HtmlFormatter` (`HtmlFormatter::nodeBegin`). When diffs are rendered to HTML using the built-in formatter, untrusted payloads can inject scripts and execute in the context of a consuming web page.

**Affected versions:** >= 0, < 0.7.2 **Patched version:** 0.7.2

**Remediation** Upgrade to `jsondiffpatch` `0.7.2` or later. The fix hardens the HTML formatter to avoid script injection.

**Workarounds** Avoid using the HTML formatter on untrusted diffs, or sanitize/escape the rendered output.