Recommended action window: Monitor and triage in normal cycle
NVD description
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
🚨 CRITICAL: CVE-2022-32511 (CVSS 9.8) jmespath[.]rb for Ruby <1.6.1 uses unsafe JSON[.]load instead of JSON[.]parse, enabling remote code execution. Update to v1.6.1+ immediately. #CVE #Vulnerability #PatchNow https://t.co/ntCet302zj
Post summary
The tweet alerts to CVE‑2022‑32511, explains how unsafe JSON.load in jmespath.rb allows remote code execution, and urges immediate upgrade to v1.6.1+.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | fedoraproject | fedora | 35 | - | - |
| OS | fedoraproject | fedora | 36 | - | - |
| App | jmespath | jmespath | - | ruby | - |