AIKIDO-2026-952503
fastjsonschema is vulnerable to Code Injection
59
Medium Risk
This Affects:
fastjsonschemaTL;DR
fastjsonschema compiles JSON schemas into Python validation code for speed. When a schema uses a boolean dependencies entry set to false, the dependent property name is interpolated into the generated exception code without escaping. A property name containing crafted quote-breaking content is embedded into the generated validator source, so schema-controlled code runs during schema compilation or validation. The fix escapes the property name through the internal escaping helper before it is placed into the generated code.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application compiles or validates against JSON schemas whose dependencies property names come from untrusted input.
Background info
fastjsonschema is vulnerable to Code Injection in versions 2.0 - 2.22.1.
How to fix this
Upgrade the fastjsonschema library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant