CVE-2022-30241: Cross-site Scripting in jquery.json-viewer
Summary
CVE-2022-30241: Cross-site Scripting in jquery.json-viewer. Affects jquery.json-viewer versions < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jquery.json-viewer library is a Node.js package that provides a JSON viewer for displaying JSON data in a user-friendly format. It allows users to visualize and navigate through complex JSON structures. However, prior to version 1.5.0, the library did not properly escape certain characters, such as '<', in a JSON object. This vulnerability can lead to cross-site scripting (XSS) attacks, where an attacker can inject malicious scripts into a web page viewed by a user.
Vulnerability Detail
The vulnerability in jquery.json-viewer arises from the lack of proper character escaping in JSON objects. When rendering JSON data that contains unescaped characters, such as '<', the library does not sanitize the input, allowing an attacker to inject arbitrary scripts. This can lead to the execution of malicious code in the context of the user's browser, potentially compromising sensitive information or performing unauthorized actions. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 1.5.0 as of 22 Oct 2026
npm install jquery.json-viewer@1.5.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version of jquery.json-viewer is not immediately feasible, developers can implement a workaround by manually sanitizing the JSON data before passing it to the library for rendering. This can be achieved by using a library or function that escapes special characters in JSON strings, such as the 'escape-html' module in Node.js. Here is an example of how to sanitize the JSON data using the 'escape-html' module:
const escapeHtml = require('escape-html');
const json = '{ "name": "<script>alert(1)</script>" }';
const sanitizedJson = escapeHtml(json);
By sanitizing the JSON data before rendering, the vulnerability can be mitigated.
Conclusion
In conclusion, the jquery.json-viewer library prior to version 1.5.0 is vulnerable to cross-site scripting (XSS) attacks due to improper character escaping in JSON objects. Developers should update to the latest version of the library or implement a workaround to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for jquery.json-viewer →
FAQ
The vulnerability allows an attacker to inject malicious scripts into a web page viewed by a user. This can lead to the execution of arbitrary code in the user's browser, potentially compromising sensitive information or performing unauthorized actions.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your package-lock.json file and provides real-time monitoring and alerts for open-source vulnerabilities, including this one.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Yes, developers can fix this vulnerability by updating their usage of the jquery.json-viewer library to version 1.5.0 or later. This version includes the necessary fixes to properly escape characters in JSON objects, preventing the possibility of XSS attacks.
If updating to the latest version of jquery.json-viewer is not immediately feasible, developers can implement a workaround by manually sanitizing the JSON data before passing it to the library for rendering. This can be achieved by using a library or function that escapes special characters in JSON strings, such as the 'escape-html' module in Node.js.
Related vulnerabilities
Recent vulnerabilities recorded for jquery.json-viewer.
