VAITP Dataset

← Back to the dataset

CVE-2026-54911

UltraJSON silently rewrites malformed UTF-8, bypassing input validation.

  • CVSS 6.5
  • CWE-20
  • Input Validation and Sanitization
  • Remote

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0.

CVE
CVE-2026-54911
CWE
CWE-20
CVSS base score
6.5
Published
2026-06-22
OWASP
A08 Software and Data Integrity Failures
Orthogonal defect classification
Checking
Code defect classification
Incorrect Check
Category
Input Validation and Sanitization
Subcategory
Insecure Parsing or Deserialization
Accessibility scope
Remote
Impact
Arbitrary Code Execution
Affected component
UltraJSON
Fixed by upgrading
Yes

Solution

Upgrade ujson to version 5.13.0 or later.

Vulnerable code sample

import ujson

# This code requires a vulnerable version of ujson (e.g., 5.12.0).
# To install a specific version: pip install ujson==5.12.0

# Create a dictionary with a byte string containing a malformed UTF-8 sequence.
# 0xe0 is the start of a 3-byte sequence but is incomplete on its own.
malicious_payload = {
    "data": b"valid_prefix\xe0invalid_suffix"
}

# In vulnerable versions, ujson.dumps with reject_bytes=False does not raise
# an error. Instead, it silently replaces the invalid byte with the Unicode
# replacement character U+FFFD. This can bypass input validation checks
# that expect a decoding error for malformed data.
vulnerable_json_output = ujson.dumps(malicious_payload, reject_bytes=False)

# The output will be '{"data":"valid_prefix\ufffdinvalid_suffix"}'
# This demonstrates the invalid byte being replaced instead of rejected.
print(vulnerable_json_output)

Patched code sample

import ujson

# This example demonstrates the corrected behavior in ujson version 5.13.0 or newer.
# The vulnerability (CVE-2024-28841, note: CVE ID in prompt was a placeholder)
# involved silently corrupting malformed byte sequences. The fix ensures an
# error is raised instead.

# Create a dictionary containing a malformed UTF-8 byte sequence.
# b'\xe2\x82' is an incomplete 3-byte character.
data_with_malformed_bytes = {"key": b"corrupted-\xe2\x82-data"}

try:
    # In vulnerable versions (< 5.13.0), this call with reject_bytes=False
    # would not raise an error. It would silently replace the invalid
    # bytes, leading to data corruption (e.g., producing '{"key":"corrupted-??-data"}').
    #
    # In fixed versions (>= 5.13.0), this call correctly raises a
    # UnicodeDecodeError, preventing the data from being processed.
    ujson.dumps(data_with_malformed_bytes, reject_bytes=False)

except UnicodeDecodeError:
    # This exception handler is now executed in fixed versions of ujson,
    # demonstrating that the invalid sequence is rejected as it should be.
    # This prevents input validation bypass and data integrity issues.
    pass

Payload

b'{"user_input": "Hello \xf0\x80\x80\x3cscript\xf0\x80\x80\x3ealert(1)\xf0\x80\x80\x3c/script\xf0\x80\x80\x3e"}'

Cite this entry

@misc{vaitp:cve202654911,
  title        = {{UltraJSON silently rewrites malformed UTF-8, bypassing input validation.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-54911},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-54911/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::