CVE-2026-29036
cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.26%
- CWE
- CWE-706
- Published
- 2026-08-11
- Last modified
- 2026-08-14
Affected products
- DaveGamble cJSON
Weakness type
Related vulnerabilities
- CVE-2026-87618 — Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36...
- CVE-2026-87562 — Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior to 153.0.8010.36...
- CVE-2026-87613 — Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a...
- CVE-2026-87547 — Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a...
- CVE-2026-81383 — Visual Studio Code Information Disclosure Vulnerability
- CVE-2026-79254 — Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65...
- CVE-2026-79273 — Incorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65...
- CVE-2026-79103 — Incorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote...