JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable

🗓️ 07 Jun 2022 00:00:31Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 211 Views

JMESPath for Ruby vulnerability in JSON processing

Reporter	Title	Published	Views	Family All 27
attackerkb	CVE-2022-32511	6 Jun 202222:15	–	attackerkb
circl	CVE-2022-32511	7 Jun 202202:30	–	circl
cnnvd	jmespath.rb 安全漏洞	6 Jun 202200:00	–	cnnvd
cve	CVE-2022-32511	6 Jun 202221:55	–	cve
cvelist	CVE-2022-32511	6 Jun 202221:55	–	cvelist
debiancve	CVE-2022-32511	6 Jun 202221:55	–	debiancve
euvd	EUVD-2022-5934	3 Oct 202520:07	–	euvd
fedora	[SECURITY] Fedora 36 Update: rubygem-jmespath-1.6.1-1.fc36	17 Jun 202201:15	–	fedora
fedora	[SECURITY] Fedora 35 Update: rubygem-jmespath-1.6.1-1.fc35	17 Jun 202201:19	–	fedora
nvd	CVE-2022-32511	6 Jun 202222:15	–	nvd

Vulners

Node

jmespath jmespathRange<1.6.1rubygems

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-32511
github	www.github.com/jmespath/jmespath.rb/pull/55
github	www.github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
stackoverflow	www.stackoverflow.com/a/30050571/580231
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/jmespath/CVE-2022-32511.yml
github	www.github.com/jmespath/jmespath.rb/commit/e8841280053a9d9a0c90f36223f926c8b9e4ec49
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5

08 Jul 2026 17:32Current

8.9High risk

Vulners AI Score8.9

CVSS 27.5

CVSS 3.19.8

EPSS0.02131