PT-2026-137177
CVE-2026-122234
·
Published
2026-11-04
·
Updated
2026-11-04
Description by
CVSS 3.1
4.7
MediumMetricsAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.
Found an issue in the description? Have something to add? Feel free to write us 👾