Is CVE-2025-9910 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-9910 being exploited in the wild.

How severe is CVE-2025-9910?

Low severity, with a CVSS score of 3.1, published 11 September 2025.

Which products and versions are affected?

jsondiffpatch (npm) SEMVER:introduced=0,fixed=0.7.2.

Is there a fix for CVE-2025-9910?

Yes. jsondiffpatch (npm): upgrade to 0.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-9910 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-9910?

Check whether you run jsondiffpatch (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-9910: jsondiffpatch Cross-site Scripting in HtmlFormatter

CVE-2025-9910 · Severity: low · CVSS 3.1 · Published 2025-09-11

jsondiffpatch is a library used to compare and display differences between JavaScript objects. A vulnerability in its HTML formatting component allows an attacker to inject malicious scripts into the comparison results. If a website uses this library to display differences from untrusted data, an attacker could execute code in a user's browser, potentially leading to session hijacking or unauthorized actions on the user's behalf.

Technologies: jsondiffpatch (npm). Vendors: npm.

Quick answers

Is CVE-2025-9910 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-9910 being exploited in the wild.
How severe is CVE-2025-9910?: Low severity, with a CVSS score of 3.1, published 11 September 2025.
Which products and versions are affected?: jsondiffpatch (npm) SEMVER:introduced=0,fixed=0.7.2.
Is there a fix for CVE-2025-9910?: Yes. jsondiffpatch (npm): upgrade to 0.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-9910 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-9910?: Check whether you run jsondiffpatch (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jsondiffpatch (npm): upgrade to 0.7.2 or later
```
npm install jsondiffpatch@0.7.2
```

Technical details

A DOM-based Cross-site Scripting (XSS) vulnerability exists in jsondiffpatch's HtmlFormatter::nodeBegin and error message handling. The root cause is insufficient sanitization of JSON keys and error strings when generating HTML output. An attacker can exploit this by providing a specially crafted JSON object containing malicious script tags as keys. When the library's built-in HTML formatter renders the difference between this malicious object and another, the script is executed in the context of the victim's browser. This requires the application to render diffs from untrusted sources and typically involves user interaction to view the rendered output. The vulnerability is addressed in version 0.7.2 by hardening the HTML formatter and escaping output.

Affected products

benjamine jsondiffpatch < 0.7.2

Identifiers

CVE-2025-9910
GHSA-33vc-wfww-vjfv

Timeline

2025-03-03: disclosed: Issue first reported on GitHub
2025-09-11: advisory: GHSA and CVE published
2025-09-11: patched: Version 0.7.2 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.