Threats tagged 'ghsa-36c7-f344-vj2m'

jsondiffpatch versions before 0.7.7 have a cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious markup by providing an unescaped array-move destination index in a delta. If an attacker controls the delta passed to the formatters.html.format() or formatters.annotated.format() functions, they can embed scripts that execute in the context of the application's origin when the output is rendered.