PT-2025-37115
CVE-2025-9910
·
Published
2025-09-11
·
Updated
2026-10-05
Description by
CVSS 3.1
4.7
MediumMetricsAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
jsondiffpatch versions prior to 0.7.2
Description:
The package is susceptible to Cross-site Scripting (XSS) via
HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads, potentially leading to code execution if untrusted payloads are used as a source for the diff and the result is rendered using the built-in html formatter on a private website.Recommendations:
Update to version 0.7.2 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾