The json-smart library includes a flaw in its strict‑mode validation that permits an attacker to insert a literal 0x1A character and append malformed content. This bypass tricks the JSONValue.parseStrict and isValidJsonStrict methods into accepting data that otherwise would fail validation, creating a differential in how the data is parsed by the library versus downstream libraries such as Jackson or Gson. The immediate effect is that trusted components may receive data that was not intended to be valid JSON, which can lead to subtle logic errors, data corruption, or elevated exposure to subsequent injection or parsing attacks.

All installations of the json-smart library up to and including version 2.6.0 are affected, as the flaw resides in its core parser classes.

The CVSS score of 6.9 indicates medium severity. No EPSS score is available, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit this flaw by supplying crafted input to any application using json‑smart's strict‑mode parser, which requires no special privileges. If the supplied data influences downstream components that perform further validation or execution, the impact could be amplified. Based on the description, it is inferred that an attacker could exploit this vulnerability by sending crafted JSON payload through any channel that permits control over the JSON content, such as web requests or API calls.