AIKIDO-2026-517233
jsonschema-rs is vulnerable to Improper Input Validation
59
Medium Risk
This Affects:
jsonschema-rsTL;DR
jsonschema-rs validates numeric instances against minimum, maximum, and their exclusive variants using arbitrary-precision numbers, which are always enabled. Integer instances just outside the i64/u64 range are compared against these bounds after a lossy conversion to f64, so a value one step beyond the limit rounds onto the boundary and is treated as satisfying it. An instance that actually violates a numeric bound can therefore be accepted as valid, bypassing the schema constraint on untrusted input. The fix compares such out-of-range integers exactly instead of using f64 rounding.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
jsonschema-rs is vulnerable to Improper Input Validation in versions 0.35.0 - 0.47.0.
How to fix this
Upgrade the jsonschema-rs library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant