CVE-2026-29036

HIGH 7.5

cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.

CWE	CWE-706
Vendor	davegamble
Product	cjson
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for davegamble cjson

Be the first to know when new high vulnerabilities affecting davegamble cjson are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

DaveGamble / cJSON

1.5.0 ≤ 1.7.19

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/DaveGamble/cJSON vulncheck.com: https://www.vulncheck.com/advisories/cjson-wrong-key-modification-via-json-pointer-escape-decoding

Credits

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.