{
  "verdict": "confirmed",
  "cve": "CVE-2026-8657",
  "cwe": "CWE-1321",
  "package": "jsondiffpatch",
  "affected_version": "0.7.5",
  "fixed_version": "0.7.6",
  "vulnerable_indicators": {
    "patch_proto_polluted": true,
    "patch_constructor_polluted": true,
    "jsonpatch_add_polluted": true,
    "jsonpatch_replace_polluted": true,
    "fresh_object_injected": true,
    "details": "On jsondiffpatch@0.7.5, applying a delta with __proto__ or constructor.prototype paths causes Object.prototype to be polluted. A freshly created plain object ({}) inherits injected properties (pp1-pp4)."
  },
  "fixed_indicators": {
    "patch_proto_rejected": true,
    "patch_constructor_rejected": true,
    "jsonpatch_add_rejected": true,
    "jsonpatch_replace_rejected": true,
    "fresh_object_clean": true,
    "details": "On jsondiffpatch@0.7.6, dangerous path segments (__proto__, constructor, prototype) are rejected by the guard in the patch traversal. A freshly created plain object ({}) does not inherit any injected properties."
  },
  "reproduction_summary": "The reproduction script installs jsondiffpatch@0.7.5 (vulnerable) and jsondiffpatch@0.7.6 (fixed), then runs a Node.js test that applies crafted deltas targeting __proto__ and constructor.prototype via both jsondiffpatch.patch() and the jsonpatch formatter's patch(). The vulnerable version pollutes Object.prototype (confirmed by fresh objects carrying injected properties). The fixed version rejects the dangerous segments and leaves the prototype untouched."
}