Executive brief
jsondiffpatch is a library used by developers to compare and display differences between JSON data objects. A security flaw in its "annotated" display mode allows attackers to inject malicious scripts into web pages if the application displays differences from untrusted data. This could lead to unauthorized actions being performed in a user's browser, such as stealing session information or defacing the website.
Technical details
The jsondiffpatch library's annotated formatter fails to properly sanitize JSON values and property names before embedding them into HTML output. Specifically, the formatter serializes deltas using JSON.stringify and passes them to internal functions like context.row(), nodeBegin(), and wrapPropertyName(), which interpolate these strings directly into the DOM without HTML escaping. If an application renders this output using innerHTML, an attacker can provide a crafted JSON object containing HTML tags (e.g., <script> or <img> with onerror) to execute arbitrary JavaScript in the context of the victim's browser. This is a DOM-based XSS vulnerability requiring the application to process and display untrusted diff data. The issue is fixed in version 0.7.6.
Affected products
- benjamine jsondiffpatch < 0.7.6
Timeline
- 2026-05-01: disclosed: Vulnerability reported by Yuki Matsuhashi
- 2026-05-15: advisory: Snyk published advisory SNYK-JS-JSONDIFFPATCH-16635946
- 2026-05-16: disclosed: CVE-2026-8656 published