id: PYSEC-2026-1245
published: "2026-07-07T14:34:45.946805Z"
modified: "2026-07-07T17:23:54.178743Z"
aliases:
- CVE-2024-53848
- GHSA-q6mv-284r-mp36
summary: check-jsonschema default caching for remote schemas allows for cache confusion
details: "### Impact\n\nThe default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. `https://example.org/schema.json` will be stored as `schema.json`. This naming allows for conflicts. If an attacker can get a user to run `check-jsonschema` against a malicious schema URL, e.g., `https://example.evil.org/schema.json`, they can insert their own schema into the cache and it will be picked up and used instead of the appropriate schema.\n\nSuch a cache confusion attack could be used to allow data to pass validation which should have been rejected.\n\n### Patches\n\nA patch is in progress but has not yet been released.\n\n### Workarounds\n\n- Users can use `--no-cache` to disable caching.\n- Users can use `--cache-filename` to select filenames for use in the cache, or to ensure that other usages do not overwrite the cached schema. (Note: this flag is being deprecated as part of the remediation effort.)\n- Users can explicitly download the schema before use as a local file, as in `curl -LOs https://example.org/schema.json; check-jsonschema --schemafile ./schema.json`"
affected:
- package:
    name: check-jsonschema
    ecosystem: PyPI
    purl: pkg:pypi/check-jsonschema
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.30.0
  versions:
  - 0.1.0
  - 0.1.1
  - 0.10.0
  - 0.10.1
  - 0.10.2
  - 0.11.0
  - 0.12.0
  - 0.13.0
  - 0.14.0
  - 0.14.1
  - 0.14.2
  - 0.14.3
  - 0.15.0
  - 0.15.1
  - 0.16.0
  - 0.16.1
  - 0.16.2
  - 0.17.0
  - 0.17.1
  - 0.18.0
  - 0.18.1
  - 0.18.2
  - 0.18.3
  - 0.18.4
  - 0.19.0
  - 0.19.1
  - 0.19.2
  - 0.2.0
  - 0.2.1
  - 0.20.0
  - 0.21.0
  - 0.22.0
  - 0.23.0
  - 0.23.1
  - 0.23.2
  - 0.23.3
  - 0.24.0
  - 0.24.1
  - 0.25.0
  - 0.26.0
  - 0.26.1
  - 0.26.2
  - 0.26.3
  - 0.27.0
  - 0.27.1
  - 0.27.2
  - 0.27.3
  - 0.27.4
  - 0.28.0
  - 0.28.1
  - 0.28.2
  - 0.28.3
  - 0.28.4
  - 0.28.5
  - 0.28.6
  - 0.29.0
  - 0.29.1
  - 0.29.2
  - 0.29.3
  - 0.29.4
  - 0.3.0
  - 0.3.1
  - 0.3.2
  - 0.4.0
  - 0.4.1
  - 0.5.0
  - 0.5.1
  - 0.6.0
  - 0.7.0
  - 0.7.1
  - 0.8.0
  - 0.8.1
  - 0.8.2
  - 0.9.0
  - 0.9.1
references:
- type: WEB
  url: https://github.com/python-jsonschema/check-jsonschema/security/advisories/GHSA-q6mv-284r-mp36
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2024-53848
- type: FIX
  url: https://github.com/python-jsonschema/check-jsonschema/commit/c52714b85e6725b1b24516fbdedacb333b939152
- type: PACKAGE
  url: https://github.com/python-jsonschema/check-jsonschema
- type: PACKAGE
  url: https://pypi.org/project/check-jsonschema
- type: ADVISORY
  url: https://github.com/advisories/GHSA-q6mv-284r-mp36
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- type: CVSS_V4
  score: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N