CVE-2026-113602
MediumCVSS 5.3Summary
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.
Risk Assessment
An attacker can smuggle malicious data past validation, causing parser differentials and potential application security gaps. This can lead to unexpected behavior and bypass of security controls.
Recommendation
Update json-smart to a version later than 2.6.0. Ensure JSON validation is consistent across components.
Other vulnerabilities in json-smart
Original NVD description (English source)
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS