jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…fpatch/security/advisories/GHSA-jhmf-rq89-q58p Üretici bülteni
• github.com/…ommit/c6b2d97b34bc2356c816d8dd0f8b1c8af16bb6af Yama
• vulncheck.com/…-via-array-move-destination-in-html-formatters Üçüncü taraf

Kayıt geçmişi

1. 5 Kas 2026 00:06Yayımlandı

İlgili açıklar

• 6,4 CVE-2026-104812Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key
• 6,4 CVE-2026-120533Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile
• 6,4 CVE-2026-120553Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute
• 2,4 CVE-2026-122190SourceCodester Online Food Ordering System Category Management add_category.php cross site scripting
• 5,4 CVE-2026-54380VitaFit Cloud API Stored XSS via SVG File Upload
• 6,1 CVE-2025-71453vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList