CVE-2022-31116: ujson - Incorrect handling of invalid surrogate pair characters
Summary
CVE-2022-31116: Incorrect handling of invalid surrogate pair characters. Affects ujson versions < 5.4.0. Fixed in 5.4.0. How to fix ↓
Also tracked for
- ujson · Debian:11
The same CVE-2022-31116 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ujson is a Python library that provides ultra-fast JSON encoding and decoding. It is commonly used to parse JSON data from untrusted sources. However, a vulnerability has been discovered in ujson that affects the handling of invalid surrogate pair characters in JSON strings.
Vulnerability Detail
The vulnerability arises when JSON strings contain escaped surrogate characters that are not part of a proper surrogate pair. In such cases, ujson decodes these characters incorrectly, leading to string corruption. This vulnerability also allows for potential key confusion and value overwriting in dictionaries. Attackers can exploit this to manipulate JSON data and potentially execute arbitrary code.
How To Fix
Latest published version: 6.0.0 as of 23 Oct 2026
pip install --upgrade "ujson==6.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.4.0
This is the first release that contains the fix.
pip install --upgrade "ujson==5.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no safe alternatives to upgrading ujson. Switching to a different JSON library is not recommended as it may introduce other vulnerabilities or compatibility issues. It is crucial to upgrade to UltraJSON 5.4.0 or later to address this vulnerability.
Conclusion
The vulnerability in ujson's handling of invalid surrogate pair characters can lead to string corruption and potential code execution. It is crucial to upgrade to UltraJSON 5.4.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ujson →
FAQ
Anyone parsing JSON from an untrusted source using ujson is vulnerable to this issue.
The incorrect handling of invalid surrogate pair characters can lead to string corruption, key confusion, and value overwriting in dictionaries. This can be exploited by attackers to manipulate JSON data and potentially execute arbitrary code.
Yes, the vulnerability has been patched in UltraJSON 5.4.0. Users should upgrade to this version or later to fix the issue.
No, upgrading to the latest version of ujson is the only recommended solution. Switching to a different JSON library may introduce other vulnerabilities or compatibility issues.
For more information, you can open an issue in the UltraJSON GitHub repository: http://github.com/ultrajson/ultrajson/issues
References
Related vulnerabilities
Recent vulnerabilities recorded for ujson.
