PT-2026-70929 · Cjson · Cjson
CVE-2026-29036
·
Published
2026-08-11
·
Updated
2026-08-13
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
cJSON versions 1.5.0 through 1.7.19
Description
An incorrectly-resolved name or reference issue exists in the
decode pointer inplace() function within cJSON Utils.c. Unauthenticated attackers can cause JSON Patch operations to target incorrect object keys by providing crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. By submitting malicious RFC 6902 JSON Patch input to applications utilizing cJSONUtils ApplyPatches() or cJSONUtils ApplyPatchesCaseSensitive(), attackers may silently corrupt data or delete unintended keys, which could lead to the bypass of authorization controls in applications relying on JSON Patch for access-controlled data modification.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
As a temporary workaround, restrict the use of the
cJSONUtils ApplyPatches() and cJSONUtils ApplyPatchesCaseSensitive() functions when processing untrusted JSON Patch input.Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cjson