https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 13:53:26 +0000 https://vulnerability.circl.lu/vuln/ghsa-33vc-wfww-vjfv <p><strong>Affected:</strong> npm: jsondiffpatch</p> <p>### Vulnerability in jsondiffpatch</p> <p>Versions of `jsondiffpatch` prior to `0.7.2` are vulnerable to Cross-site Scripting (XSS) in the `HtmlFormatter` (`HtmlFormatter::nodeBegin`). When diffs are rendered to HTML using the built-in formatter, untrusted payloads can inject scripts and execute in the context of a consuming web page.</p> <p>**Affected versions:** &gt;= 0, &lt; 0.7.2 **Patched version:** 0.7.2</p> <p>**Remediation** Upgrade to `jsondiffpatch` `0.7.2` or later. The fix hardens the HTML formatter to avoid script injection.</p> <p>**Workarounds** Avoid using the HTML formatter on untrusted diffs, or sanitize/escape the rendered output.</p> <p><strong>Affected:</strong> npm: jsondiffpatch</p> <p>### Vulnerability in jsondiffpatch</p> <p>Versions of `jsondiffpatch` prior to `0.7.2` are vulnerable to Cross-site Scripting (XSS) in the `HtmlFormatter` (`HtmlFormatter::nodeBegin`). When diffs are rendered to HTML using the built-in formatter, untrusted payloads can inject scripts and execute in the context of a consuming web page.</p> <p>**Affected versions:** &gt;= 0, &lt; 0.7.2 **Patched version:** 0.7.2</p> <p>**Remediation** Upgrade to `jsondiffpatch` `0.7.2` or later. The fix hardens the HTML formatter to avoid script injection.</p> <p>**Workarounds** Avoid using the HTML formatter on untrusted diffs, or sanitize/escape the rendered output.</p> https://vulnerability.circl.lu/vuln/ghsa-33vc-wfww-vjfv