CVE-2026-8656 — Cross-Site Scripting (XSS)

title: CVE-2026-8656 - jsondiffpatch XSS via Annotated Formatter
id: scw-2026-05-16-ai-1
status: experimental
level: medium
description: |
  Detects attempts to exploit CVE-2026-8656 by injecting JavaScript payloads into the query string of web requests. This rule specifically looks for patterns indicative of XSS attacks targeting the jsondiffpatch annotated formatter, such as common script tags or event handlers often used in XSS payloads.
author: SCW Feed Engine (AI-generated)
date: 2026-05-16
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8656/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri-query|contains:
          - '<script>alert('CVE-2026-8656')</script>'
      cs-uri-query|contains:
          - 'onerror='
      cs-uri-query|contains:
          - 'javascript:'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse