MEDIUM SEVERITYCONFIRMED

Non-ASCII (CJK) characters pass isalnum() filter unchanged

Package
MiroFish
Version
latest
Verified
2026-03-28

Description

MiroFish uses Python's `isalnum()` to filter usernames. CJK and other Unicode characters return `True` for `isalnum()` — `'张'.isalnum()` is `True`. The filter intended for ASCII alphanumeric validation passes all Unicode letters and digits unchanged.

Reproduction

'张'.isalnum()  # True
# CJK names pass through the username filter unchanged
← All bugsScan your code →