CLEANSTART-2026-MI55197: json-smart through 2

Q: How can I determine whether an installation is in scope?

Inventory deployments of the cleanstart/sonarqube package and identify the json-smart version they use. The supplied advisory information identifies json-smart versions through 2 as affected.

Q: Is a fixed version or workaround identified in the available advisory data?

No fixed version, workaround, exploit prerequisites, or mitigation guidance is provided in the supplied data. Prioritize verifying the installed json-smart version and consult the referenced advisory records for updated remediation details.

Published Nov 7, 2026

Updated

Security vulnerability affects the sonarqube package. json-smart through 2.

Affected Software

1 affected componentFixes available

cleanstart/sonarqube<26.7.0.124771-r12

26.7.0.124771-r12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.7.0.124771-r12

Event History

Nov 7, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-113602

Frequently Asked Questions

How can I determine whether an installation is in scope?

Inventory deployments of the cleanstart/sonarqube package and identify the json-smart version they use. The supplied advisory information identifies json-smart versions through 2 as affected.

Is a fixed version or workaround identified in the available advisory data?

No fixed version, workaround, exploit prerequisites, or mitigation guidance is provided in the supplied data. Prioritize verifying the installed json-smart version and consult the referenced advisory records for updated remediation details.

CLEANSTART-2026-MI55197: json-smart through 2

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

How can I determine whether an installation is in scope?

Is a fixed version or workaround identified in the available advisory data?

Company

Resources

Contact

Frequently Asked Questions

How can I determine whether an installation is in scope?

Is a fixed version or workaround identified in the available advisory data?