{"id":"CVE-2025-9910","aliases":["EUVD-2025-27629","GHSA-33vc-wfww-vjfv","ROOT-APP-NPM-CVE-2025-9910"],"status":"published","title":"jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin","description":"Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00315,"percentile":0.24582,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-09-11T05:00:02Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"npm","package":"jsondiffpatch","fixed_in":["0.7.2"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"jsondiffpatch","fixed_in":["0.6.0-aikido.2","0.6.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/jsondiffpatch","fixed_in":["0.6.0-root.io.1","0.6.0-root.io.2","0.6.0-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"jsondiffpatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2"}]}]},{"source":"osv","ecosystem":"npm","package":"jsondiffpatch","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"jsondiffpatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-aikido.2"},{"fixed":"0.6.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/jsondiffpatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-root.io.1"},{"fixed":"0.6.0-root.io.2"},{"fixed":"0.6.0-root.io.3"}]}]}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-10369031","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-12549276","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-12549277","tags":["web"]},{"url":"https://github.com/benjamine/jsondiffpatch/commit/0e374b5dd8d7879b329a9fc18affbd46ad50dd14","tags":["fix","web"]},{"url":"https://github.com/benjamine/jsondiffpatch/issues/383","tags":["report","web"]},{"url":"https://benjamine.github.io/jsondiffpatch/index.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9910","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-33vc-wfww-vjfv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9910.json","tags":["advisory"]},{"url":"https://github.com/benjamine/jsondiffpatch","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-9910","description":"Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.","status":"published","published":"2025-09-11T05:00:02.071Z","modified":"2025-09-11T13:09:13.093Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P","level":"low","assessor":"cna"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:34.096798Z"}],"euvd":[{"id":"EUVD-2025-27629","description":"Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.","status":"published","published":"2025-09-11T05:00:02Z","modified":"2025-09-11T13:09:13Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T20:31:45.093776Z"}],"ghsa":[{"id":"GHSA-33vc-wfww-vjfv","title":"jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin","description":"### Vulnerability in jsondiffpatch\n\nVersions of `jsondiffpatch` prior to `0.7.2` are vulnerable to Cross-site Scripting (XSS) in the `HtmlFormatter` (`HtmlFormatter::nodeBegin`). When diffs are rendered to HTML using the built-in formatter, untrusted payloads can inject scripts and execute in the context of a consuming web page.\n\n**Affected versions:** \u003e= 0, \u003c 0.7.2\n**Patched version:** 0.7.2\n\n**Remediation**\nUpgrade to `jsondiffpatch` `0.7.2` or later. The fix hardens the HTML formatter to avoid script injection.\n\n**Workarounds**\nAvoid using the HTML formatter on untrusted diffs, or sanitize/escape the rendered output.","status":"published","published":"2025-09-11T06:30:23Z","modified":"2025-09-22T22:45:33Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:58.965005Z"}],"nvd":[{"id":"CVE-2025-9910","description":"Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.","status":"published","published":"2025-09-11T05:15:34.137Z","modified":"2026-10-19T17:10:00.173Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:28.834562Z"}],"osv":[{"id":"CVE-2025-9910","description":"Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.","status":"published","published":"2025-09-11T05:00:02.071Z","modified":"2026-10-28T02:30:40.7671437Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:53.490346Z"},{"id":"GHSA-33vc-wfww-vjfv","title":"jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin","description":"### Vulnerability in jsondiffpatch\n\nVersions of `jsondiffpatch` prior to `0.7.2` are vulnerable to Cross-site Scripting (XSS) in the `HtmlFormatter` (`HtmlFormatter::nodeBegin`). When diffs are rendered to HTML using the built-in formatter, untrusted payloads can inject scripts and execute in the context of a consuming web page.\n\n**Affected versions:** \u003e= 0, \u003c 0.7.2\n**Patched version:** 0.7.2\n\n**Remediation**\nUpgrade to `jsondiffpatch` `0.7.2` or later. The fix hardens the HTML formatter to avoid script injection.\n\n**Workarounds**\nAvoid using the HTML formatter on untrusted diffs, or sanitize/escape the rendered output.","status":"published","published":"2025-09-11T06:30:23Z","modified":"2026-09-10T03:50:27.847806501Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"ROOT-APP-NPM-CVE-2025-9910","title":"CVE-2025-9910 in jsondiffpatch - Patched by Root","description":"Root has patched CVE-2025-9910 in the jsondiffpatch package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-05T07:38:51Z","modified":"2026-10-05T08:15:04.085671616Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.362922Z"}]}}