LiveActive security incident?Get immediate response
CVE Record

CVE-2026-8657: Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpa...

Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON Patch documents, as attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like __proto__ or constructor.prototype, allowing modification of Object.prototype.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2026-8657 affects jsondiffpatch before 0.7.6. If an application lets untrusted users submit delta or JSON Patch documents processed by vulnerable APIs, attackers may tamper with JavaScript object behavior through prototype pollution. This can undermine application integrity and sometimes availability, depending on how polluted properties are later used.

Executive priority

Prioritize remediation for internet-facing or multi-tenant applications that accept user-controlled patch data. Treat as high priority because exploitation needs no authentication or user interaction when the vulnerable API is reachable, though confirmed active exploitation is not documented in the provided sources.

Technical view

The flaw is CWE-1321 prototype pollution in jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch(). Attacker-controlled property names or path segments can traverse into special properties such as __proto__ or constructor.prototype and modify Object.prototype. The CVSS v4 score is 8.8 high, with network, low-complexity, no-privilege, no-user-interaction characteristics.

Likely exposure

Exposure is most likely in Node.js or Java WebJars applications using jsondiffpatch before 0.7.6 and applying untrusted deltas or JSON Patch documents. Internal-only use with trusted patch data is lower risk, but still should be upgraded during normal dependency maintenance.

Exploitation context

Sources do not show CISA KEV listing or confirmed active exploitation. The CVE indicates proof-of-concept exploit maturity and public references include researcher material. Practical impact depends on whether attacker-supplied patch data reaches the vulnerable APIs and whether polluted prototype properties influence security-sensitive logic.

Researcher notes

Focus review on data flow into patch application APIs and downstream reliance on inherited object properties. The referenced commit appears to address unsafe traversal of prototype-related keys. Avoid assuming remote code execution; prototype pollution impact is application-specific and may range from integrity failures to broader compromise chains.

Mitigation direction

  • Upgrade jsondiffpatch to 0.7.6 or later where used.
  • Upgrade org.webjars.npm:jsondiffpatch to a non-vulnerable version.
  • Do not process untrusted deltas or JSON Patch documents until upgraded.
  • Add input validation blocking prototype-related property paths as defense-in-depth.
  • Review vendor and package advisory guidance for environment-specific instructions.

Validation and detection

  • Inventory npm and Java WebJars dependencies for jsondiffpatch versions before 0.7.6.
  • Search code for jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() usage.
  • Confirm whether external or tenant-controlled data reaches those APIs.
  • Verify dependency lockfiles and deployed artifacts use version 0.7.6 or later.
  • Run SCA scans after remediation to confirm the finding is closed.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-1321: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-8657 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 4.0HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P——snyk
8.2CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P3.94.2snyk

Vulnerability scoring details

Base CVSS 4.0 score

8.8High
CVSS 4.0 vector shape for CVE-2026-8657Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/ajsondiffpatch0Listed
n/aorg.webjars.npm:jsondiffpatch0Listed
Weakness

CWE details

CWE-1321

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-1321 · source CWE mapping

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs