CVE-2026-113602
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
json-smart
- Vendor
- json-smart
- Product
- json-smart
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | semver | Unavailable | 2.6.0 | None listed |