CVE-2026-8657
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Prototype Pollution vulnerability in jsondiffpatch before version 0.7.6 allows an attacker to modify Object.prototype by supplying crafted delta or JSON Patch documents. The issue stems from unrestricted access to special properties like __proto__ or constructor.prototype in the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs.
Risk Assessment
The risk for the organization includes potential remote code execution, privilege escalation, or data integrity compromise, as an attacker can inject malicious properties into the global object prototype, affecting the entire application's behavior.
Recommendation
Immediately upgrade jsondiffpatch to version 0.7.6 or later, which includes a fix for this vulnerability. Additionally, review application code for usage of the vulnerable APIs and consider implementing input validation.
Original NVD description (English source)
Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON Patch documents, as attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like __proto__ or constructor.prototype, allowing modification of Object.prototype.