AIKIDO-2025-10425

TL;DR

Affected versions of this package have a Use-After-Free vulnerability in the into_object_iter function. If the ObjectJsonIter is dropped prematurely, borrowed keys become dangling pointers to freed memory. Accessing these keys can result in undefined behavior, including segmentation faults or data leaks. An attacker can exploit this by using crafted JSON input to retain keys after the iterator is destroyed, potentially causing crashes or enabling remote code execution.