Junglewise Threat Intelligence

CVE-2025-9910: jsondiffpatch Cross-site Scripting in HtmlFormatter

CVE-2025-9910 · Severity: low · CVSS 3.1 · Published 2025-09-11

Technologies: jsondiffpatch (npm). Vendors: npm.

Executive brief

jsondiffpatch is a library used to compare and display differences between JavaScript objects. A vulnerability in its HTML formatting component allows an attacker to inject malicious scripts into the comparison results. If a website uses this library to display differences from untrusted data, an attacker could execute code in a user's browser, potentially leading to session hijacking or unauthorized actions on the user's behalf.

Technical details

A DOM-based Cross-site Scripting (XSS) vulnerability exists in jsondiffpatch's HtmlFormatter::nodeBegin and error message handling. The root cause is insufficient sanitization of JSON keys and error strings when generating HTML output. An attacker can exploit this by providing a specially crafted JSON object containing malicious script tags as keys. When the library's built-in HTML formatter renders the difference between this malicious object and another, the script is executed in the context of the victim's browser. This requires the application to render diffs from untrusted sources and typically involves user interaction to view the rendered output. The vulnerability is addressed in version 0.7.2 by hardening the HTML formatter and escaping output.

Affected products

  • benjamine jsondiffpatch < 0.7.2

Timeline

  • 2025-03-03: disclosed: Issue first reported on GitHub
  • 2025-09-11: advisory: GHSA and CVE published
  • 2025-09-11: patched: Version 0.7.2 released with fix

References

Related threats