CVE-2026-8656 describes a Cross-site Scripting (XSS) vulnerability in the jsondiffpatch package prior to version 0.7.6. The issue arises from the annotated formatter's failure to properly sanitize JSON values and property names. When applications compare untrusted JSON or object data and render the annotated formatter output directly into the DOM, attacker-controlled HTML can be interpreted by the browser, leading to XSS. The vulnerability is classified under CWE-79 and has a CVSS 4.0 score of 5.1, indicating medium severity. No patch or official remediation guidance is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary HTML or script code in the context of the victim's browser when untrusted JSON data is rendered using the vulnerable annotated formatter. This can lead to typical XSS impacts such as session hijacking, defacement, or redirection. However, exploitation requires the application to render untrusted JSON data with the annotated formatter in a way that the browser interprets attacker-controlled HTML.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid rendering untrusted JSON data with the annotated formatter in the DOM or implement strict sanitization and output encoding of JSON values and property names before rendering. Monitor vendor channels for updates regarding an official fix.