AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-29036

HIGH · CVSS 7.5 EPSS 0.26% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-11 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

Versions 1.5.0 through 1.7.19 of cJSON are vulnerable due to an incorrectly-resolved name or reference issue in the decode_pointer_inplace() function, which allows unauthenticated attackers to manipulate JSON Patch operations. By supplying crafted JSON Pointer escape sequences, attackers can corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that utilize JSON Patch for data modification. Developers and organizations using affected cJSON versions should prioritize patching to mitigate the risk of unauthorized data manipulation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-29036
Severity
HIGH
CVSS
7.5
EPSS
0.26%

Original NVD Description

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.