jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin

Description

Versions of jsondiffpatch prior to 0.7.2 are vulnerable to Cross-site Scripting (XSS) in the HtmlFormatter (HtmlFormatter::nodeBegin). When diffs are rendered to HTML using the built-in formatter, untrusted payloads can inject scripts and execute in the context of a consuming web page.

Affected versions: >= 0, < 0.7.

Recommendation

Update the jsondiffpatch package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.7.2
• Patched version(s): 0.7.2

References

• GHSA-33vc-wfww-vjfv
• benjamine.github.io
• security.snyk.io
• CVE-2025-9910
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6