Description

Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.

INFO

Published Date :

2025-09-11T05:00:02.071Z

Last Modified :

2025-09-11T13:09:13.093Z

Source :

snyk
AFFECTED PRODUCTS

The following products are affected by CVE-2025-9910 vulnerability.

Vendors Products
Jsondiffpatch Project
  • Jsondiffpatch
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-9910.

URL Resource
https://benjamine.github.io/jsondiffpatch/index.html cve-icon cve-icon
https://github.com/benjamine/jsondiffpatch/commit/0e374b5dd8d7879b329a9fc18affbd46ad50dd14 cve-icon cve-icon
https://github.com/benjamine/jsondiffpatch/issues/383 cve-icon cve-icon
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-12549277 cve-icon cve-icon
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-12549276 cve-icon cve-icon
https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-10369031 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact