CVE-2026-122234
LOW
INFO
Priority: 0.00
BB Relevance:
55/100
Published: 2026-11-04
Modified: 2026-11-04
First seen: 2026-11-04
Status: active
Attack Surface
Network
Low Complexity
No Auth
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Passive
AT:
Present
VC:
None
VI:
None
VA:
None
Description
jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| benjamine | jsondiffpatch | 0 < 0.7.7 |