Cross-Site Scripting Vulnerability in jsondiffpatch Library from Benjamine

CVE-2025-9910

What is CVE-2025-9910?

The jsondiffpatch library before version 0.7.2 is susceptible to a Cross-Site Scripting vulnerability that can be exploited through the HtmlFormatter::nodeBegin method. If an attacker uses untrusted payloads for generating diffs, they can inject harmful scripts into HTML content. This risk is particularly pronounced when the resulting diff is rendered using the library's built-in HTML formatter on private websites, potentially leading to unauthorized code execution.

References