Description

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T22:17:22.257Z",
  "pubdate": "2026-08-11T22:17:22.257Z",
  "executiveSummary": "An incorrectly-resolved name or reference vulnerability exists in cJSON versions 1.5.0 through 1.7.19 within the decode_pointer_inplace() function of cJSON_Utils.c. The flaw allows unauthenticated remote attackers to cause JSON Patch operations to target incorrect object keys by supplying crafted JSON Pointer escape sequences such as ~0 or ~1 within patch paths. When applications process malicious RFC 6902 JSON Patch inputs via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(), attackers can achieve silent data corruption or deletion of unintended keys. This condition poses significant risk as it can potentially bypass authorization controls in applications relying on JSON Patch for access-controlled data modifications, leading to integrity violations and unauthorized state changes.",
  "technicalDetails": "The vulnerability resides in the decode_pointer_inplace() function located in cJSON_Utils.c, affecting cJSON versions 1.5.0 through 1.7.19. The root cause stems from improper resolution of names and references when parsing JSON Pointer strings that include specific escape sequences, specifically ~0 and ~1 as defined in RFC 6902. Unauthenticated attackers can exploit this flaw by submitting crafted JSON Patch input containing maliciously constructed escape sequences within patch paths. During the execution of cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(), the vulnerable decoding logic misinterprets the escape sequences, causing the patch operation to resolve to an unintended object key instead of the intended target. The attack flow involves an external attacker supplying an engineered JSON Patch payload to an application exposing the vulnerable patch application functions. Upon parsing, the flawed reference resolution mechanism targets wrong object keys in the underlying JSON structure. Post-exploitation impact includes the silent corruption of application data, deletion of critical unintended keys, and potential circumvention of authorization controls implemented at the application layer for access-controlled data modifications. The vulnerability requires no authentication or special privileges, making it exploitable via standard network or input vectors where applications process untrusted JSON Patch payloads."
}