PT-2026-51093 · Pypi · Ultrajson

Zwique · Published 2026-06-19 · Updated 2026-06-22 · CVE-2026-54911

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions UltraJSON versions prior to 5.13.0

Description The functions ujson.dumps(), ujson.dump(), and ujson.encode() contain an issue when the reject bytes variable is set to False. In this configuration, the software may accept malformed or truncated UTF-8 byte sequences and silently rewrite them into different Unicode characters instead of rejecting them. This behavior can lead to data integrity issues and the bypass of input validation if such validation is performed before serialization. Technical examples include the replacement of invalid continuation bytes with valid ones, the completion of unterminated sequences, or reading past the end of a string.

Recommendations Update to version 5.13.0. As a temporary workaround, decode bytes to strings in Python before passing them to the ujson.dumps() function.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-54911

GHSA-3J69-69WJ-XQX2

Affected Products

Ultrajson

References · 6

• https://osv.dev/vulnerability/GHSA-3j69-69wj-xqx2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54911 · Security Note
• https://github.com/ultrajson/ultrajson · Note
• https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf · Note
• https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2 · Note
• https://github.com/ultrajson/ultrajson/releases/tag/5.13.0 · Note