CVE-2026-113602Medium· 5.3▾ TwilightPoC availableA flaw was found in json-smart. A remote attacker can exploit this input validation bypass vulnerability by submitting crafted JSON data containing a literal substitute (0x1A) character followed by malformed content. This causes strict-mod…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
Exploit / PoC code exists
0.4%
Last analysed / modified upstream
0.4% → 0.4%
A flaw was found in json-smart. A remote attacker can exploit this input validation bypass vulnerability by submitting crafted JSON data containing a literal substitute (0x1A) character followed by malformed content. This causes strict-mode validation checks to prematurely finish parsing and accept the invalid input. Consequently, this inconsistency can create parser differentials with downstream JSON parsers, potentially enabling attackers to bypass security filters or cause data integrity issues.
net.minidev/json-smart: json-smart: Input validation bypass via substitute character in strict mode — rated Moderate by Red Hat. Released 2026-10-20, updated 2026-10-23.
Affected:
No fix planned:
Out of support scope
Workarounds / mitigations:
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-41293High· 7.3tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
CVE-2026-110759Critical· 9.8Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse
CVE-2025-39703Medium· 6.5kernel: net, hsr: reject HSR frame if skb can't hold tag (CVE-2025-39703)
CVE-2026-106071Low· 3.6nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
CVE-2026-106072Medium· 6.7nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)
CVE-2026-106073Low· 3.3nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)