GHSA-jhmf-rq89-q58p: jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters
jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsondiffpatchto a version that resolves this vulnerability.Fixed in 0.7.7
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they use a jsondiffpatch version before 0.7.7 and render attacker-controlled deltas through formatters.html.format() or formatters.annotated.format(). The injected markup executes in the application's origin when that formatter output is rendered.
What must an attacker control to exploit the vulnerability?
An attacker must be able to supply a delta that reaches one of the affected HTML formatters. The malicious value is placed in an unescaped array-move destination index.
Are applications that only generate or process diffs affected?
The described execution path requires rendering output from formatters.html.format() or formatters.annotated.format(). The provided information does not identify impact for other formatter or non-rendering uses.