CVE-2020-23849: Cross-site Scripting in jsoneditor
Summary
CVE-2020-23849: Cross-site Scripting in jsoneditor. Affects jsoneditor versions < 9.0.2. Fixed in 9.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The jsoneditor package is an npm package that provides a user-friendly interface for editing JSON data. It allows users to view and modify JSON data in a tree or text mode. The package is widely used in web applications to handle JSON data. However, versions before 9.0.2 are vulnerable to a stored cross-site scripting (XSS) attack in the tree mode. This vulnerability allows an attacker to inject and execute malicious JavaScript code, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The stored XSS vulnerability in jsoneditor before version 9.0.2 occurs when user-supplied input is not properly sanitized before being rendered in the tree mode. An attacker can exploit this vulnerability by injecting malicious JavaScript code into the JSON data. When the data is displayed in the tree mode, the injected code is executed in the context of the user's browser, allowing the attacker to perform actions on behalf of the user. This can include stealing sensitive information, modifying the user's data, or performing other malicious activities. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 10.4.3 as of 22 Oct 2026
npm install jsoneditor@10.4.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.0.2
This is the first release that contains the fix.
npm install jsoneditor@9.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 9.0.2 is not immediately possible, a temporary workaround is to disable the tree mode in jsoneditor or switch to the text mode. This can be done by modifying the configuration of the jsoneditor component in the application code. Here is an example of how to disable the tree mode:
const jsonEditor = new JSONEditor(element, { mode: 'text' });
Conclusion
In conclusion, jsoneditor versions before 9.0.2 are vulnerable to a stored XSS attack in the tree mode. This can allow an attacker to execute malicious JavaScript code in the user's browser, potentially leading to unauthorized access or data theft. To mitigate this vulnerability, developers should upgrade to jsoneditor version 9.0.2 or later. If immediate upgrade is not possible, disabling the tree mode or switching to the text mode can provide temporary protection. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jsoneditor →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of the user's browser. This can lead to unauthorized access, data theft, or other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any known vulnerabilities, including this one.
While there is no specific known exploit for this vulnerability in the public domain, it is important to address it promptly to prevent potential attacks.
The recommended mitigation is to upgrade to jsoneditor version 9.0.2 or later. If immediate upgrade is not possible, disabling the tree mode or switching to the text mode can provide temporary protection.
Yes, the fix for this vulnerability is included in jsoneditor version 9.0.2. Developers should upgrade to this version to ensure their applications are secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for jsoneditor.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
