# CVE-2026-8656: jsondiffpatch Cross-site Scripting in annotated formatter

Source: https://junglewise.ai/threats/cve-2026-8656-jsondiffpatch-cross-site-scripting-in-annotated-formatter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-16. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-8656 · Severity: medium · CVSS 6.1 · Published 2026-05-16

jsondiffpatch is a library used by developers to compare and display differences between JSON data objects. A security flaw in its "annotated" display mode allows attackers to inject malicious scripts into web pages if the application displays differences from untrusted data. This could lead to unauthorized actions being performed in a user's browser, such as stealing session information or defacing the website.

## Quick answers

**Is CVE-2026-8656 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8656 being exploited in the wild.

**How severe is CVE-2026-8656?** Medium severity, with a CVSS score of 6.1, published 16 May 2026.

**Which products and versions are affected?** benjamine jsondiffpatch < 0.7.6.

**Is there a fix for CVE-2026-8656?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8656 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8656?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The jsondiffpatch library's annotated formatter fails to properly sanitize JSON values and property names before embedding them into HTML output. Specifically, the formatter serializes deltas using JSON.stringify and passes them to internal functions like context.row(), nodeBegin(), and wrapPropertyName(), which interpolate these strings directly into the DOM without HTML escaping. If an application renders this output using innerHTML, an attacker can provide a crafted JSON object containing HTML tags (e.g., <script> or <img> with onerror) to execute arbitrary JavaScript in the context of the victim's browser. This is a DOM-based XSS vulnerability requiring the application to process and display untrusted diff data. The issue is fixed in version 0.7.6.

## Affected products

- benjamine jsondiffpatch < 0.7.6

## Timeline

- 2026-05-01: disclosed: Vulnerability reported by Yuki Matsuhashi
- 2026-05-15: advisory: Snyk published advisory SNYK-JS-JSONDIFFPATCH-16635946
- 2026-05-16: disclosed: CVE-2026-8656 published

## References

- [https://gist.github.com/yuki-matsuhashi/72ed072d919f3c52adba298faa6a7da5](https://gist.github.com/yuki-matsuhashi/72ed072d919f3c52adba298faa6a7da5)
- [https://github.com/benjamine/jsondiffpatch/commit/232338b34c4653148ca2f44e897a765b72c8c98f](https://github.com/benjamine/jsondiffpatch/commit/232338b34c4653148ca2f44e897a765b72c8c98f)
- [https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-16635946](https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-16635946)