{"action":"Upgrade ujson to 5.13.0 or later.","affected":[{"fixed":"5.13.0","introduced":"0"}],"component":"ujson","cve_ids":["CVE-2026-54911"],"ecosystem":"PyPI","epss":0.00371,"exploited":false,"fixed_versions":["5.13.0"],"ghsa_id":"GHSA-3j69-69wj-xqx2","id":"tcs_01M5KGYKNVTYHM7RMS1PJT8BPT","modified_at":"2026-07-13T07:15:45.403361942Z","published_at":"2026-06-22T22:16:50.397Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2294","https://github.com/ultrajson/ultrajson/releases/tag/5.13.0","https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf","https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-2294","url":"https://osv.dev/vulnerability/PYSEC-2026-2294"}],"summary":"UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When"}