CVE-2026-122234: jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters

Published Nov 4, 2026

Updated

jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade jsondiffpatch to a version that resolves this vulnerability.
Fixed in 0.7.7

Event History

Nov 4, 2026

CVE Published

via MITRE·09:06 PM

Data Sourced

via MITRE·09:06 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using jsondiffpatch versions before 0.7.7 are exposed only when they pass attacker-controlled deltas to formatters.html.format() or formatters.annotated.format() and render the resulting HTML in the application’s origin.

What must an attacker control to exploit it?

The attacker must be able to supply a delta containing an unescaped array-move destination index. Exploitation also requires a user to render the formatter output, at which point injected script can execute in the application’s origin.

What can be done if an immediate upgrade is not possible?

Do not pass untrusted deltas to the affected HTML formatter functions or render their output. Restrict delta sources to trusted data until jsondiffpatch can be updated to 0.7.7 or later.

CVE-2026-122234: jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker control to exploit it?

What can be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker control to exploit it?

What can be done if an immediate upgrade is not possible?