Executive brief
jquery.json-viewer is a Node.js library used to display and render JSON data in web browsers. A cross-site scripting vulnerability allows attackers to inject malicious scripts by crafting JSON objects with unescaped special characters, potentially enabling session hijacking, credential theft, or malware distribution to end users viewing the rendered JSON.
Technical details
A cross-site scripting (XSS) vulnerability exists in jquery.json-viewer versions before 1.5.0 due to improper escaping of special characters (such as <) in JSON object keys and values during HTML rendering. The vulnerability is triggered when JSON containing script elements or other malicious HTML is rendered without sanitization. An attacker can craft a JSON payload containing SCRIPT elements or event handlers that execute in the browser context of any user viewing the rendered output. The attack requires user interaction (viewing the malicious JSON), but does not require authentication. The vulnerability was fixed in version 1.5.0.
Affected products
- jquery.json-viewer contributors jquery.json-viewer before 1.5.0
Timeline
- 2022-05-05: disclosed
- 2022-05-03: patched