cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the
    decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON
    Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1)
    in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using
    cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete
    unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for
    access-controlled data modification. (CVE-2026-29036)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the     decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON     Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1)     in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using     cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete     unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for     access-controlled data modification. (CVE-2026-29036)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
472823	Echo: cjson: security update to 1.7.18-3.1+deb13u1+e2	Tenable Cloud Security	Echo Local Security Checks	Local	high
472823	Echo: cjson: security update to 1.7.18-3.1+deb13u1+e2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
335311	Linux Distros Unpatched Vulnerability : CVE-2026-29036	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-29036

high

Tenable Plugins

high

high

high