GitStock

benjamine/jsondiffpatch · Security

jsondiffpatch patch APIs are vulnerable to prototype pollution

GHSA ID
GHSA-j4fx-xxwh-2485
CVE ID
CVE-2026-8657
Severity
high
Published
Updated
CVSS
8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CVSS v3
8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CVSS v4
7.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P

Description

Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON Patch documents, as attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like proto or constructor.prototype, allowing modification of Object.prototype.

CWEs

  • CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

References

Open GitHub