Cross-Site Scripting Vulnerability in jsondiffpatch Library from Benjamine

CVE-2025-9910

What is CVE-2025-9910?

The jsondiffpatch library before version 0.7.2 is susceptible to a Cross-Site Scripting vulnerability that can be exploited through the HtmlFormatter::nodeBegin method. If an attacker uses untrusted payloads for generating diffs, they can inject harmful scripts into HTML content. This risk is particularly pronounced when the resulting diff is rendered using the library's built-in HTML formatter on private websites, potentially leading to unauthorized code execution.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References