id: PYSEC-2026-2294
published: "2026-06-22T22:16:50.397Z"
modified: "2026-07-13T05:52:19.768615Z"
aliases:
- CVE-2026-54911
- GHSA-3j69-69wj-xqx2
details: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.
affected:
- package:
    name: ujson
    ecosystem: PyPI
    purl: pkg:pypi/ujson
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 5.13.0
  versions:
  - "1.15"
  - "1.18"
  - "1.19"
  - "1.21"
  - "1.22"
  - "1.23"
  - "1.30"
  - "1.33"
  - "1.34"
  - "1.35"
  - "1.4"
  - "1.6"
  - "1.8"
  - "1.9"
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 3.0.0
  - 3.1.0
  - 3.2.0
  - 4.0.0
  - 4.0.1
  - 4.0.2
  - 4.1.0
  - 4.2.0
  - 4.3.0
  - 5.0.0
  - 5.1.0
  - 5.10.0
  - 5.11.0
  - 5.12.0
  - 5.12.1
  - 5.2.0
  - 5.3.0
  - 5.4.0
  - 5.5.0
  - 5.6.0
  - 5.7.0
  - 5.8.0
  - 5.9.0
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://github.com/ultrajson/ultrajson/releases/tag/5.13.0
- type: FIX
  url: https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf
- type: FIX
  url: https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N