CVE-2026-67217

cJSON up to 1.7.19 has a non-atomic JSON Patch handler in cJSON_Utils.c (apply_patch) that detaches/deletes the target member for a replace without a value or an unresolved move before full validation. This allows an attacker-supplied patch to mutate the target document even when the patch report...