npm jsondiffpatch vulnerabilities

Latest npm jsondiffpatch CVEs

Newest publication first

1. CVE-2026-122234 jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters

   Published 2026-11-04

   Low·CVSS 2.3 EPSS 0.18%

   jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can...

2. CVE-2026-8657 jsondiffpatch patch APIs are vulnerable to prototype pollution

   Published 2026-05-16

   High·CVSS 8.8 EPSS 0.38%

   Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON Patch documents, as attacker-...

3. CVE-2025-9910 jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin

   Published 2025-09-11

   Low·CVSS 2.3 EPSS 0.33%

   Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and th...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.