MEDIUM SEVERITYCONFIRMED
Non-ASCII (CJK) characters pass isalnum() filter unchanged
Package
MiroFish
Version
latest
Verified
2026-03-28
Description
MiroFish uses Python's `isalnum()` to filter usernames. CJK and other Unicode characters return `True` for `isalnum()` — `'张'.isalnum()` is `True`. The filter intended for ASCII alphanumeric validation passes all Unicode letters and digits unchanged.
Reproduction
'张'.isalnum() # True
# CJK names pass through the username filter unchanged