Ecosystem	Package	Version

Vulnerabilities

CVE-2025-67221

CVE-2025-67221

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

Published Jan 23, 2026

https://github.com/advisories/GHSA-hx9q-6w63-j58v

CVSS ScoreMedium

5.5

Ecosystem	Package	Version


npm	@liwanhe/ai-cli-tool	1.4.1
pypi	orjson	1.0.0
pypi	orjson	1.0.1
pypi	orjson	1.1.0
pypi	orjson	1.2.0
pypi	orjson	1.2.1
pypi	orjson	1.3.0
pypi	orjson	1.3.1
pypi	orjson	2.0.0
pypi	orjson	2.0.10
pypi	orjson	2.0.11
pypi	orjson	2.0.1
pypi	orjson	2.0.2
pypi	orjson	2.0.3
pypi	orjson	2.0.4
pypi	orjson	2.0.5
pypi	orjson	2.0.6
pypi	orjson	2.0.7
pypi	orjson	2.0.8
pypi	orjson	2.0.9
pypi	orjson	2.1.0
pypi	orjson	2.1.1
pypi	orjson	2.1.2
pypi	orjson	2.1.3
pypi	orjson	2.1.4
pypi	orjson	2.2.0
pypi	orjson	2.2.1
pypi	orjson	2.2.2
pypi	orjson	2.3.0
pypi	orjson	2.4.0
pypi	orjson	2.5.0
pypi	orjson	2.5.1
pypi	orjson	2.5.2
pypi	orjson	2.6.0
pypi	orjson	2.6.1
pypi	orjson	2.6.2
pypi	orjson	2.6.3
pypi	orjson	2.6.4
pypi	orjson	2.6.5
pypi	orjson	2.6.6
pypi	orjson	2.6.7
pypi	orjson	2.6.8
pypi	orjson	3.0.0
pypi	orjson	3.0.1
pypi	orjson	3.0.2
pypi	orjson	3.1.0
pypi	orjson	3.1.1
pypi	orjson	3.1.2
pypi	orjson	3.10.0
pypi	orjson	3.10.10

CVE-2025-67221 | Components Impacted | Sonatype Guide | Sonatype Guide