CVE-2022-32511

CriticalCVSS 9.8

Published: 06/06/2022(UTC)Updated: 15/06/2026(UTC)Translated: 16/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.13%

80th percentile - higher than 80% of all known CVEs

Summary

Versions of jmespath.rb before 1.6.1 use JSON.load in a situation where JSON.parse would be preferable. This may lead to unexpected behavior in JSON data processing.

Risk Assessment

Using JSON.load instead of JSON.parse may increase the risk of attacks related to data processing, potentially leading to unauthorized access or modification of data.

Recommendation

It is recommended to update jmespath.rb to version 1.6.1 or later to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.