EUVD-2026-117120

jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format or formatters.annotated.format can embed script that...

CVE-2026-122234

The jsondiffpatch library, in versions before 0.7.7 , is vulnerable to a cross-site scripting (XSS) flaw. The root cause is the handling of an unescaped array-move destination index within a delta. Attackers who can control a delta passed to the formatters.html.format() or formatters.annotated.fo...