CVE-2026-122234 jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters

Low 2.3 Published 4 Nov 2026 Updated 9 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-122234?

CVE-2026-122234 is a low-severity vulnerability in benjamine jsondiffpatch, published on 4 Nov 2026.

Official description

jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.

Weakness: CWE-79

Which versions are affected by CVE-2026-122234?

How do I fix CVE-2026-122234?

No fix has been published for CVE-2026-122234 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-122234 being exploited?

There is no known exploitation of CVE-2026-122234 in the wild and no public exploit code.

Sources

Also known as GHSA-36c7-f344-vj2m, GHSA-jhmf-rq89-q58p.