Cross-site Scripting Vulnerability in jsondiffpatch Affects Various Applications

CVE-2026-8656

What is CVE-2026-8656?

Versions of jsondiffpatch prior to 0.7.6 exhibit a Cross-site Scripting (XSS) vulnerability due to inadequate sanitization of JSON values and property names within the annotated formatter. When applications process untrusted JSON or object data and display the formatted output in the DOM, there is a risk that attacker-controlled HTML may be executed by the browser, which could lead to significant security breaches.

References