AIKIDO-2026-952503

fastjsonschema is vulnerable to Code Injection

Code Injection Pre-CVE Published Aug 21, 2026

Medium Risk

This Affects:

fastjsonschema

2.0 - 2.22.1

Fixed in 2.22.2

Are you affected? Scan for Free

TL;DR

fastjsonschema compiles JSON schemas into Python validation code for speed. When a schema uses a boolean dependencies entry set to false, the dependent property name is interpolated into the generated exception code without escaping. A property name containing crafted quote-breaking content is embedded into the generated validator source, so schema-controlled code runs during schema compilation or validation. The fix escapes the property name through the internal escaping helper before it is placed into the generated code.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application compiles or validates against JSON schemas whose dependencies property names come from untrusted input.