CVE-2026-8657 Details

A prototype pollution vulnerability has been identified in the jsondiffpatch package, affecting versions prior to 0.7.6. The issue arises in the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs, where attacker-controlled property names and path segments can be used to traverse and modify objects. This manipulation occurs without proper restrictions on access to special properties like __proto__ or constructor.prototype, allowing attackers to alter Object.prototype. The vulnerability can be exploited by supplying crafted delta or JSON Patch documents that take advantage of these unguarded property accesses.

Users are advised to upgrade jsondiffpatch to version 0.7.6 or later.