Executive brief
jquery.json-viewer is a JavaScript library used to display and interact with JSON data in web applications. A vulnerability in versions before 1.3.0 allows attackers to inject malicious JavaScript code through specially crafted JSON payloads, potentially compromising user sessions or stealing sensitive information when the JSON is rendered in a browser.
Technical details
This is a Cross-Site Scripting (CWE-79) vulnerability in jquery.json-viewer versions prior to 1.3.0. The root cause is insufficient sanitization of user input when the library constructs HTML anchor tags from JSON data. An attacker can craft JSON containing event handler attributes (e.g., onmouseover) that are concatenated directly into the href attribute or surrounding HTML, allowing arbitrary JavaScript execution in the victim's browser when the link is interacted with. The attack requires the vulnerable library to be used to render attacker-controlled JSON. The vulnerability has been fixed in version 1.3.0 and later.
Affected products
- jquery.json-viewer jquery.json-viewer before 1.3.0
Timeline
- 2020-09-03: disclosed: GHSA-v9wp-8r97-v6xg published
- 2020-09-03: patched: Fixed in version 1.3.0