{"id":"PYSEC-2026-2294","details":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.","aliases":["CVE-2026-54911","GHSA-3j69-69wj-xqx2"],"modified":"2026-07-13T07:15:45.403361942Z","published":"2026-06-22T22:16:50.397Z","references":[{"type":"ADVISORY","url":"https://github.com/ultrajson/ultrajson/releases/tag/5.13.0"},{"type":"FIX","url":"https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf"},{"type":"FIX","url":"https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2"}],"affected":[{"package":{"name":"ujson","ecosystem":"PyPI","purl":"pkg:pypi/ujson"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.0"}]}],"versions":["1.15","1.18","1.19","1.21","1.22","1.23","1.30","1.33","1.34","1.35","1.4","1.6","1.8","1.9","2.0.0","2.0.1","2.0.2","2.0.3","3.0.0","3.1.0","3.2.0","4.0.0","4.0.1","4.0.2","4.1.0","4.2.0","4.3.0","5.0.0","5.1.0","5.10.0","5.11.0","5.12.0","5.12.1","5.2.0","5.3.0","5.4.0","5.5.0","5.6.0","5.7.0","5.8.0","5.9.0"],"ecosystem_specific":{},"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/ujson/PYSEC-2026-2294.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}