Executive brief
cJSON is a lightweight JSON parsing library used in many applications to process JSON data. The library contains a flaw in how it handles JSON Patch operations that use special escape sequences, allowing attackers to cause patches to modify incorrect object keys or delete unintended data. This could enable attackers to corrupt application data or bypass access controls in systems that rely on JSON Patch for data modifications.
Technical details
The vulnerability is an incorrectly-resolved name or reference flaw (CWE-706) in the decode_pointer_inplace() function within cJSON_Utils.c. The function fails to properly decode JSON Pointer escape sequences (~0 and ~1) according to RFC 6902, allowing attackers to craft malicious JSON Patch input that targets wrong object keys. The flaw affects the cJSONUtils_ApplyPatches() and cJSONUtils_ApplyPatchesCaseSensitive() functions, which process RFC 6902 JSON Patch operations. Unauthenticated network attackers can exploit this by submitting crafted escape sequences in patch paths to silently corrupt data, delete unintended keys, or bypass authorization controls. Versions 1.5.0 through 1.7.19 are affected; patches should be available in later releases.
Affected products
- DaveGamble cJSON 1.5.0 through 1.7.19
Timeline
- 2026-08-11: disclosed