Vulnerabilities in pkg:pypi/ujson

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3j69-69wj-xqx2",
  "modified" : "2026-07-18T17:28:55Z",
  "published" : "2026-06-19T20:47:43Z",
  "aliases" : [ "CVE-2026-54911" ],
  "summary" : "UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()",
  "details" : "### Summary\n`ujson.dumps()` (or `ujson.dump()` or `ujson.encode()`) have a `reject_bytes=False` option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues.\n\n### Details\n\nThe expected behavior is that for `x` being any bytes string, `x == ujson.loads(ujson.dumps(x, reject_bytes=False)).encode(errors=\"surrogatepass\")` should always either be true or `ujson.dumps()` will throw an exception. In reality, some strings which should've been errors are silently rewritten as other strings:\n\n* Invalid continuation bytes are replaced with valid ones: `b'\\xcf\\x13'` -> `b'\\xcf\\x93'`\n* Unterminated sequence completes the sequence: `b'\\xc3'` -> `b'\\xc3\\x80'`\n* ... or leads to reading past the end of string: `b'\\xf0\\x90\\x94'` -> `b\"\\xf0\\x90\\x94\\x80inxcontrib'\"`\n\n### Impact\n\nAn application relying on reject_bytes=False for UTF-8 handling may experience:\n\n- Data integrity issues\n- Experience validation bypass if said validation occurs before serialisation\n\n### Remediation\n\nThe missing/broken UTF-8 validation checks were added/fixed in https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf. We recommend upgrading to [UltraJSON 5.13.0](https://github.com/ultrajson/ultrajson/releases/tag/5.13.0).\n\n### Workarounds\n\nDecoding bytes to strings in Python before passing them to `ujson.dumps()` avoids this issue.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "ujson"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "5.13.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.12.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-54911"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/ujson/PYSEC-2026-2294.yaml"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ultrajson/ultrajson"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ultrajson/ultrajson/releases/tag/5.13.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-19T20:47:43Z",
    "nvd_published_at" : "2026-06-22T22:16:50Z"
  }
}