~ / search / GHSA-j4fx-xxwh-2485

GHSA-j4fx-xxwh-2485

jsondiffpatch patch APIs are vulnerable to prototype pollution

Source: GitHub Advisory Database (reviewed) High CVE-2026-8657

Packages

EcosystemPackageAffectedFixed in
npm jsondiffpatch < 0.7.6 0.7.6

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON Patch documents, as attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like __proto__ or constructor.prototype, allowing modification of Object.prototype.

References

External links from the advisory. They lead to third-party sites.