CVE-2026-29036 Incorrectly-Resolved Reference in cJSON

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability within the decode_pointer_inplace() function of cJSON_Utils.c. The flaw exists in how the library handles JSON Pointer escape sequences, specifically the '~0' and '~1' sequences defined in RFC 6902. An unauthenticated attacker providing malicious JSON Patch input to an application that utilizes cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() can force the library to reference incorrect keys within a JSON object. This allows for data corruption, unauthorized key deletion, or the modification of sensitive configuration fields, potentially bypassing security controls in downstream applications. Because cJSON is a ubiquitous C library for JSON parsing and utility, the scope of affected applications is extensive, requiring developers to audit their use of the cJSON_Utils module and apply patches to version 1.7.20 or later.

Impact

The vulnerability poses a significant risk to applications relying on JSON Patch operations for data mutation or access control. Successful exploitation leads to unauthorized modification or deletion of data within JSON objects. While the library itself is OS-agnostic, the impact is determined by the permissions of the application processing the malicious payload. This could result in privilege escalation or business logic bypasses depending on how the application handles the manipulated JSON structures.

Recommendation

• Identify all applications within your environment that bundle or link against cJSON versions 1.5.0 through 1.7.19.
• Prioritize patching for internet-facing applications that expose JSON Patch functionality to unauthenticated users.
• Implement strict input validation on all JSON Patch operations before passing the input to the cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() functions to ensure escape sequences do not reference unauthorized keys.
• If immediate patching is not possible, implement application-layer controls to sanitize JSON Pointer paths by filtering for unexpected '~' characters before processing.