Cross-Site Scripting Vulnerability in jsondiffpatch from Benjamine

CVE-2026-122234

What is CVE-2026-122234?

The jsondiffpatch library, prior to version 0.7.7, is susceptible to a cross-site scripting vulnerability that could allow an attacker to compromise web applications. This vulnerability arises when an unescaped array-move destination index is supplied in the delta parameter, which can result in the injection of malicious markup. If an attacker has control over a delta passed to the HTML formatters, they can embed executable scripts that may run within the application's origin environment, leading to unauthorized actions and potential data breaches.

References