Quick answers
- Is CVE-2026-8656 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-8656 being exploited in the wild.
- How severe is CVE-2026-8656?
- Medium severity, with a CVSS score of 6.1, published 16 May 2026.
- Which products and versions are affected?
- benjamine jsondiffpatch < 0.7.6.
- Is there a fix for CVE-2026-8656?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-8656 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-8656?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The jsondiffpatch library's annotated formatter fails to properly sanitize JSON values and property names before embedding them into HTML output. Specifically, the formatter serializes deltas using JSON.stringify and passes them to internal functions like context.row(), nodeBegin(), and wrapPropertyName(), which interpolate these strings directly into the DOM without HTML escaping. If an application renders this output using innerHTML, an attacker can provide a crafted JSON object containing HTML tags (e.g., <script> or <img> with onerror) to execute arbitrary JavaScript in the context of the victim's browser. This is a DOM-based XSS vulnerability requiring the application to process and display untrusted diff data. The issue is fixed in version 0.7.6.
Affected products
- benjamine jsondiffpatch < 0.7.6
Timeline
- 2026-05-01: disclosed: Vulnerability reported by Yuki Matsuhashi
- 2026-05-15: advisory: Snyk published advisory SNYK-JS-JSONDIFFPATCH-16635946
- 2026-05-16: disclosed: CVE-2026-8656 published