Product Repositoryproduct
https://github.com/DaveGamble/cJSON CVE-2026-29036
HIGH
cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding
Record summary
CVE-2026-29036 has a selected CVSS score of 8.7 (high).
Description
cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 13, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Default status: affected | CVE List | 1.5.0 to ≤ 1.7.19 | affected |
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-29036 vulncheck.comThird-party advisory
https://www.vulncheck.com/advisories/cjson-wrong-key-modification-via-json-pointer-escape-decoding