VDB
CVE-2025-9910
CVE-2025-9910
PUBLISHED
CVSS 4.699999809265137 MEDIUM
jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin
EPSS 0.30% · 21.7th percentile
Risk Scores
CVSS 3.1
4.699999809265137
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
0.30%
21.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | jsondiffpatch | 0 |
| n/a | org.webjars.npm:jsondiffpatch | 0 |
| n/a | org.webjars.bower:jsondiffpatch | 0 |
| npm | jsondiffpatch | 0 |
Timeline
- Sep 11, 2025 CVE Published
- Sep 11, 2025 EPSS Score
- Sep 11, 2025 PoC Published
- Sep 19, 2025 EPSS Score
- Sep 22, 2025 CVE Updated
- Sep 27, 2025 EPSS Score
- Oct 5, 2025 EPSS Score
- Oct 13, 2025 EPSS Score
- Oct 20, 2025 EPSS Score
- Oct 28, 2025 EPSS Score
- Nov 5, 2025 EPSS Score
- Nov 13, 2025 EPSS Score
References
- https://github.com/benjamine/jsondiffpatch/commit/0e374b5dd8d7879b329a9fc18affbd46ad50dd14 fix
- https://github.com/benjamine/jsondiffpatch/issues/383 discussion
- https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-10369031 url
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-12549276 url
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-12549277 url
- https://benjamine.github.io/jsondiffpatch/index.html url
- https://nvd.nist.gov/vuln/detail/CVE-2025-9910 advisory
- https://github.com/benjamine/jsondiffpatch package