GitStock

benjamine/jsondiffpatch · Security

jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin

GHSA ID
GHSA-33vc-wfww-vjfv
CVE ID
CVE-2025-9910
Severity
medium
Published
Updated
CVSS
4.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v3
4.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Description

Vulnerability in jsondiffpatch

Versions of jsondiffpatch prior to 0.7.2 are vulnerable to Cross-site Scripting (XSS) in the HtmlFormatter (HtmlFormatter::nodeBegin). When diffs are rendered to HTML using the built-in formatter, untrusted payloads can inject scripts and execute in the context of a consuming web page.

Affected versions: >= 0, < 0.7.2 Patched version: 0.7.2

Remediation Upgrade to jsondiffpatch 0.7.2 or later. The fix hardens the HTML formatter to avoid script injection.

Workarounds Avoid using the HTML formatter on untrusted diffs, or sanitize/escape the rendered output.

CWEs

  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References

Open GitHub