json-smart vulnerabilities

CVEs whose affected-version data names the json-smart package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-113602Medium· 5.3PoC

yesterday

json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character

json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSO…

▾ Twilightjson-smart · json-smartvia CVEORG