What’s Vulnerable › Vulnerabilities
CVE-2022-32511: JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-06-06 · updated 2026-10-08
Description
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
Affected products
- Fedoraproject Fedora: 35, 36
- jmespath.php: before 1.6.1 — fixed in 1.6.1
- Rubygems Jmespath: before 1.6.1; 0.2.0, 0.9.0, 1.0.0, 1.0.1, 1.0.2, 1.1.0 (+13) — fixed in 1.6.1
How to fix
Upgrade to a fixed version: jmespath.php 1.6.1; Rubygems Jmespath 1.6.1. Check the vendor advisory for mitigations.
References
- https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
- https://github.com/jmespath/jmespath.rb/pull/55
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5/
- https://stackoverflow.com/a/30050571/580231
- https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
- https://github.com/jmespath/jmespath.rb/pull/55
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5/
- https://stackoverflow.com/a/30050571/580231
Get alerted when CVE-2022-32511 or the next vulnerability affects your stack