Is CVE-2026-54911 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54911 being exploited in the wild.

How severe is CVE-2026-54911?

Medium severity, with a CVSS score of 6.5, published 22 June 2026.

Which products and versions are affected?

ujson (PyPI) <= 5.12.1, ECOSYSTEM:introduced=0,fixed=5.13.0; UltraJSON < 5.13.0, <= 5.12.1.

Is there a fix for CVE-2026-54911?

Yes. ujson (PyPI): upgrade to 5.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54911 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54911?

Check whether you run ujson (PyPI) or UltraJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54911: UltraJSON improper input validation in ujson.dumps UTF-8 handling

Q: Which products and versions are affected?

ujson (PyPI) <= 5.12.1, ECOSYSTEM:introduced=0,fixed=5.13.0; UltraJSON < 5.13.0, <= 5.12.1.

Q: Is there a fix for CVE-2026-54911?

Yes. ujson (PyPI): upgrade to 5.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54911 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54911?

Check whether you run ujson (PyPI) or UltraJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54911 · Severity: medium · CVSS 6.5 · Published 2026-06-22

UltraJSON is a high-performance library used by Python applications to process data in the JSON format. A flaw in how it handles certain text encoding settings allows malformed or incomplete data to be silently modified rather than rejected. This can lead to data corruption or allow attackers to bypass security filters that check data before it is saved or processed.

Technologies: ujson (PyPI), UltraJSON. Vendors: PyPI, UltraJSON.

Quick answers

Is CVE-2026-54911 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54911 being exploited in the wild.
How severe is CVE-2026-54911?: Medium severity, with a CVSS score of 6.5, published 22 June 2026.
Which products and versions are affected?: ujson (PyPI) <= 5.12.1, ECOSYSTEM:introduced=0,fixed=5.13.0; UltraJSON < 5.13.0, <= 5.12.1.
Is there a fix for CVE-2026-54911?: Yes. ujson (PyPI): upgrade to 5.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54911 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54911?: Check whether you run ujson (PyPI) or UltraJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ujson (PyPI): upgrade to 5.13.0 or later
```
pip install "ujson>=5.13.0"
```

Technical details

A vulnerability exists in UltraJSON's C-based JSON encoder (ujson.dumps, ujson.dump, and ujson.encode) when the 'reject_bytes=False' parameter is enabled. The root cause is improper validation of UTF-8 sequences, including off-by-one errors in sequence detection, missing checks for codepoints exceeding the Unicode maximum, and failure to validate continuation bytes. An attacker can provide malformed or truncated UTF-8 sequences that the library silently rewrites into valid but unintended Unicode characters. This behavior can result in data integrity issues or the bypass of security sanitization logic that occurred prior to serialization. The issue is fixed in version 5.13.0 by tightening UTF-8 validation logic.

Affected products

ultrajson UltraJSON (ujson) < 5.13.0

Identifiers

CVE-2026-54911
GHSA-3j69-69wj-xqx2
PYSEC-2026-2294

Timeline

2026-04-24: other: Initial fix commit authored
2026-06-14: patched: Version 5.13.0 released
2026-06-16: advisory: GitHub Security Advisory published
2026-06-22: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.