Executive brief
Json2html is a JavaScript HTML templating library used to convert JSON data into HTML elements on the client side. A cross-site scripting (XSS) vulnerability in versions up to 1.1.x allows attackers to inject malicious scripts into generated HTML content. An attacker could craft malicious JSON input that, when processed by a web application using this library, executes arbitrary JavaScript in users' browsers, potentially stealing session data or performing unauthorized actions.
Technical details
The vulnerability is a cross-site scripting (CWE-79) issue in the json2html.js file. The library improperly handles template attributes when converting JSON to HTML, failing to escape or sanitize user-supplied data before insertion into DOM elements. An attacker can exploit this by providing specially crafted JSON with script payloads in template values. The attack requires user interaction (rendering the malicious JSON through the application) but is remotely deliverable via network means. The vulnerability was fixed in version 1.2.0 (commit 2d3d24d) by introducing a "text" attribute option that adds plain text content rather than HTML, allowing developers to safely render untrusted data.
Affected products
- moappi Json2html up to 1.1.x
Timeline
- 2022-12-28: disclosed: Published in GitHub Advisory Database
- 2018-02-09: patched: Fixed in version 1.2.0 with commit 2d3d24d971b19a8ed1fb823596300b9835d55801