Jsondiffpatch Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the jsondiffpatch package, specifically in versions prior to 0.7.2. The issue arises in the HtmlFormatter's nodeBegin method, where an attacker can inject malicious scripts into HTML payloads. If untrusted payloads are used as the source for the diff, and the resulting renderer employs the built-in HTML formatter on a private website, this could lead to code execution.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser, potentially leading to session hijacking or cookie theft.

Reproduction

The vulnerability can be reproduced by using jsondiffpatch version 0.6.0. Inject a script tag containing a fetch command into the JSON payloads being compared. When the diff is rendered using the HTML formatter, the script will execute, demonstrating the XSS vulnerability.

Remediation

Users are advised to upgrade jsondiffpatch to version 0.7.2 or higher.