jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin

Description

Versions of jsondiffpatch prior to 0.7.2 are vulnerable to Cross-site Scripting (XSS) in the HtmlFormatter (HtmlFormatter::nodeBegin). When diffs are rendered to HTML using the built-in formatter, untrusted payloads can inject scripts and execute in the context of a consuming web page.

Affected versions: >= 0, < 0.7.

Recommendation

Update the jsondiffpatch package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.7.2
• Patched version(s): 0.7.2

References

• GHSA-33vc-wfww-vjfv
• benjamine.github.io
• security.snyk.io
• CVE-2025-9910
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Vite middleware may serve files starting with the same name with the public directory - CVE-2025-58751
• Astros's duplicate trailing slash feature leads to an open redirection security issue - CVE-2025-54793
• A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA - CVE-2023-33831
• Astro allows unauthorized third-party images in _image endpoint (GHSA-xf8x-j4p2-f749) - CVE-2025-55303

Tags:

npm

jsondiffpatch