Repository navigation
Document the security of tomllib for untrusted input #111264
Description
Activity
In PR #96499
jsondocs added the warningWarning Be cautious when parsing JSON data from untrusted sources. A malicious JSON string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.as response to CVE-2020-10735 (cpython issue #95778).
The countermeasures already exist in v3.11.0 where
tomllibfirst appears so it's not vulnerable to that particular threat at least.Reacted by Pradyun GedamLet's add a similar note. Perhaps not as a warning -- it's more about communicating what to worry about when dealing with untrusted data (it might make the fan spin but won't format your disk), but also a reminder that you should think about how trusted your data is, plus a basic precaution.
- added a commit that references this issue
on May 1, 2026 - added a commit that references this issue
on May 2, 2026
Documentation
The documentation for tomllib should be explicit on whether untrusted input is safe to parse, or what features should be avoided.
Linked PRs