CVE-2025-9910 Details
Description
Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.
A cross-site scripting (XSS) vulnerability has been identified in the jsondiffpatch package, specifically in versions prior to 0.7.2. The issue arises in the HtmlFormatter's nodeBegin method, where an attacker can inject malicious scripts into HTML payloads. If untrusted payloads are used as the source for the diff, and the resulting renderer employs the built-in HTML formatter on a private website, this could lead to code execution.
Users are advised to upgrade jsondiffpatch to version 0.7.2 or higher.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2025CISA-ADP
Assessed Sep 11, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://benjamine.github.io/jsondiffpatch/index.html | [email protected] | ProductVendor |
| https://github.com/benjamine/jsondiffpatch/commit/0e374b5dd8d7879b329a9fc18affbd46ad50dd14 | [email protected] | Source Code |
| https://github.com/benjamine/jsondiffpatch/issues/383 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-12549277 | [email protected] | AdvisoryRemedy |
| https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-12549276 | [email protected] | AdvisoryRemedy |
| https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-10369031 | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| benjamine/jsondiffpatch | All versions |
CPE
Remediation
| |
| org.webjars.bower:jsondiffpatch | All versions |
CPE
Remediation
| |
| org.webjars.npm:jsondiffpatch | All versions |
CPE
Remediation
| |
| jsondiffpatch | < 0.7.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2025 | New CVE Received | [email protected] |