CVE-2026-8656 is a Cross-site Scripting vulnerability affecting jsondiffpatch versions prior to 0.7.6. The issue arises from improper sanitization of JSON values and property names in the annotated formatter feature. When applications use this formatter to display differences between JSON objects that include untrusted data, malicious HTML can be injected and executed in the browser context. This vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No official patch or vendor advisory detailing remediation is currently available, and the package is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary HTML or script code in the context of the victim's browser when viewing annotated formatter output generated from untrusted JSON data. This can lead to typical XSS impacts such as session hijacking or content manipulation. However, exploitation requires that the vulnerable feature be used to render attacker-controlled JSON data in the DOM. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid rendering annotated formatter output in the DOM with untrusted JSON data or implement manual sanitization of JSON values and property names before rendering. Monitor vendor channels for updates regarding patches or official mitigations.