CVE-2026-29036

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-29036
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29036.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-29036
Downstream
Published
2026-08-11T21:30:01.779Z
Modified
2026-08-15T16:52:29.607072Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding
Details

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace() function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtilsApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-706"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29036.json"
}
References

Affected packages

Git / github.com/davegamble/cjson

Affected ranges

Type
GIT
Repo
https://github.com/davegamble/cjson
Events
Introduced
1217ca9e9f0134fe4666b3c81771af545c4c1b9d
Fixed
c859b25da02955fef659d658b8f324b5cde87be3
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.5.0"
        },
        {
            "last_affected": "1.7.19"
        },
        {
            "fixed": "1.7.19"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v1.*
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v1.5.8
v1.5.9
v1.6.0
v1.7.0
v1.7.1
v1.7.10
v1.7.11
v1.7.12
v1.7.13
v1.7.14
v1.7.15
v1.7.16
v1.7.17
v1.7.18
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29036.json"
vanir_signatures 
[
    {
        "target": {
            "file": "cJSON.c"
        },
        "deprecated": false,
        "source": "https://github.com/davegamble/cjson/commit/c859b25da02955fef659d658b8f324b5cde87be3",
        "id": "CVE-2026-29036-83e2c045",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "324212209976151655889958665598298635544",
                "57000550816535391230572611048963131217",
                "217784711622956909858859487036437801772",
                "143000211397577675930366937432594758406"
            ]
        },
        "signature_type": "Line"
    }
]
vanir_signatures_modified 
"2026-08-15T16:52:29Z"