/ 
Cpanel-JSON-XS-3.0217_03
⭐ Starred 39 / cpanel_json_xs
Security Advisories (6)
CVE-2025-40929 (2025-09-08)

Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

CPANSA-Cpanel-JSON-XS-2016-02 (2016-11-23)

Overflow during processing of ill-formed UTF-8 strings.

CPANSA-Cpanel-JSON-XS-2016-01

Possible overflows in av and hv length types.

CVE-2022-48623 (2023-02-21)

Wrong error messages/sometimes crashes or endless loops with invalid JSON in relaxed mode

CVE-2026-9334 (2026-06-03)

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference. A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.

CVE-2026-9516 (2026-06-03)

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the restore is skipped and the scalar is left with its string pointer offset into its own buffer and a shortened length. When that scalar is later freed, the allocator receives an invalid pointer and the interpreter aborts. A single BOM prefixed document decoded with a throwing filter callback crashes any caller.

NAME

cpanel_json_xs - Cpanel::JSON::XS commandline utility

SYNOPSIS

cpanel_json_xs [-v] [-f inputformat] [-t outputformat]

DESCRIPTION

cpanel_json_xs converts between some input and output formats (one of them is JSON).

The default input format is json and the default output format is json-pretty.

OPTIONS

-v

Be slightly more verbose.

-f fromformat

Read a file in the given format from STDIN.

fromformat can be one of:

json - a json text encoded, either utf-8, utf16-be/le, utf32-be/le
json-nonref - json according to RFC 7159
json-relaxed - json with all relaxed options
json-unknown - json with allow_unknown
storable - a Storable frozen value
storable-file - a Storable file (Storable has two incompatible formats)
bencode - use Convert::Bencode, if available (used by torrent files, among others)
clzf - Compress::LZF format (requires that module to be installed)
eval - evaluate the given code as (non-utf-8) Perl, basically the reverse of "-t dump"
yaml - loose YAML (requires YAML)
yaml-tiny - loose YAML (requires YAML::Tiny or CPAN::Meta::YAML)
yaml-xs - strict YAML 1.2 (requires YAML::XS)
yaml-syck - YAML (requires YAML::Syck)
cbor - CBOR (via CBOR::XS)
string - do not attempt to decode the file data
none - nothing is read, creates an undef scalar - mainly useful with -e
-t toformat

Write the file in the given format to STDOUT.

toformat can be one of:

json, json-utf-8 - json, utf-8 encoded
json-pretty - as above, but pretty-printed with sorted object keys
json-stringify - as json-pretty with allow_stringify
json-relaxed - as json-pretty, but with the additional options

->allow_stringify->allow_blessed->convert_blessed->allow_unknown ->allow_tags->stringify_infnan(1)

json-utf-16le, json-utf-16be - little endian/big endian utf-16
json-utf-32le, json-utf-32be - little endian/big endian utf-32
storable - a Storable frozen value in network format
storable-file - a Storable file in network format (Storable has two incompatible formats)
bencode - use Convert::Bencode, if available (used by torrent files, among others)
clzf - Compress::LZF format
yaml - loose YAML (requires YAML)
yaml-tiny - loose YAML (requires YAML::Tiny or CPAN::Meta::YAML)
yaml-xs - strict YAML 1.2 (requires YAML::XS)
yaml-syck - YAML (requires YAML::Syck)
dump - Data::Dump
dumper - Data::Dumper
string - writes the data out as if it were a string
none - nothing gets written, mainly useful together with -e

Note that Data::Dumper doesn't handle self-referential data structures correctly - use "dump" instead.

-e code

Evaluate perl code after reading the data and before writing it out again - can be used to filter, create or extract data. The data that has been written is in $_, and whatever is in there is written out afterwards.

EXAMPLES

cpanel_json_xs -t none <isitreally.json

"JSON Lint" - tries to parse the file isitreally.json as JSON - if it is valid JSON, the command outputs nothing, otherwise it will print an error message and exit with non-zero exit status.

<src.json cpanel_json_xs >pretty.json

Prettify the JSON file src.json to dst.json.

cpanel_json_xs -f storable-file <file

Read the serialized Storable file file and print a human-readable JSON version of it to STDOUT.

cpanel_json_xs -f storable-file -t yaml <file

Same as above, but write YAML instead (not using JSON at all :)

cpanel_json_xs -f none -e '$_ = [1, 2, 3]'

Dump the perl array as UTF-8 encoded JSON text.

<torrentfile cpanel_json_xs -f bencode -e '$_ = join "\n", map @$_, @{$_->{"announce-list"}}' -t string

Print the tracker list inside a torrent file.

lwp-request http://cpantesters.perl.org/show/Cpanel-JSON-XS.json | cpanel_json_xs

Fetch the cpan-testers result summary Cpanel::JSON::XS and pretty-print it.

cpanel_json_xs -f yaml-xs -t yaml-tiny <META.yml   >MYMETA.yml
cpanel_json_xs -f yaml-tiny -t yaml-xs <MYMETA.yml >XSMETA.yml
cpanel_json_xs -f yaml -t yaml <XSMETA.yml #BOOM!
Error: YAML_LOAD_ERR_BAD_MAP_ELEMENT

Compare YAML en- and decoders, and see that YAML::XS generates unparsable YAML https://github.com/ingydotnet/yaml-libyaml-pm/issues/9

AUTHOR

Copyright (C) 2008 Marc Lehmann <json@schmorp.de> Copyright (C) 2016 Cpanel Inc