CVE-2026-67217

Name of the Vulnerable Software and Affected Versions cJSON versions prior to 1.7.20

Description The apply patch() function in cJSON Utils.c performs RFC 6902 JSON Patch operations non-atomically. When a replace operation lacks a value member or a move operation has an unresolvable destination path, the target member is detached and deleted before the operation is fully validated. This results in the target document being mutated even when cJSONUtils ApplyPatches() or cJSONUtils ApplyPatchesCaseSensitive() returns a failure status. An attacker providing a malicious patch document can destroy addressable members of the target document, bypassing the expected all-or-nothing behavior used to reject invalid patches.

Recommendations Update to version 1.7.20 or later.