CVE-2026-113602 — json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character.…
Published: 2026-10-20 · CVSS: 6.9 · CVSS 4.0
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7