CVE-2026-29036

Received Received - Intake

Incorrectly-Resolved JSON Pointer in cJSONUtils Leading to Unauthorized Data Manipulation

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: VulnCheck

Description

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-29036

EUVD

EUVD-2026-57008

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-706	The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

cJSON versions 1.5.0 through 1.7.19 have a flaw in the decode_pointer_inplace() function where crafted JSON Pointer escape sequences (~0 or ~1) in patch paths can trick the system into targeting wrong object keys during JSON Patch operations. This allows unauthenticated attackers to manipulate data or delete unintended keys by submitting malicious RFC 6902 JSON Patch input to functions like cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive().

Detection Guidance

To detect this vulnerability, inspect applications using cJSON versions 1.5.0 through 1.7.19 for usage of cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). Check for malformed JSON Patch inputs containing RFC 6902 escape sequences (~0 or ~1) in patch paths.

Impact Analysis

This vulnerability can lead to data corruption, unintended key deletions, or bypassing authorization controls in applications that rely on JSON Patch for data modification. Attackers could silently alter or remove sensitive data without authentication, potentially causing application failures or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized data modification or deletion by exploiting JSON Patch operations. For GDPR, it may result in unauthorized access or erasure of personal data, violating integrity and confidentiality principles. For HIPAA, it could allow unauthorized changes to protected health information, compromising data integrity and security requirements.

Mitigation Strategies

Immediately update cJSON to version 1.7.20 or later to address the vulnerability in decode_pointer_inplace(). Review applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() for potential unauthorized data modifications or deletions.

Hi! I’m here to help you understand CVE-2026-29036. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70