VYPR
← All advisories
High severityNVD Advisory· Published Apr 28, 2020· Updated Aug 4, 2024

CVE-2020-10663

CVE-2020-10663

Description

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2020-10663 is an unsafe object creation vulnerability in the JSON gem for Ruby (through 2.2.0) that can lead to application-dependent malicious object instantiation.

Vulnerability

Overview The JSON gem through version 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, contains an Unsafe Object Creation Vulnerability [3]. This flaw is similar to CVE-2013-0269 but does not rely on poor garbage-collection behavior within Ruby [3]. The core issue lies in how JSON parsing methods can be abused to trigger the creation of arbitrary objects within the Ruby interpreter, the exact impact of which depends on the calling application [3].

Attack

Vector and Prerequisites The vulnerability is triggered when an application uses JSON.parse or similar methods on attacker-controlled JSON input [3]. An attacker can supply a crafted JSON document that, when parsed, forces the interpreter to instantiate a malicious object [3]. No specific authentication is required beyond the ability to supply input to a vulnerable parsing function. The attack surface is broad, as many Ruby web applications and services parse JSON from external sources without stringent type validation.

Impact and

Consequences Successful exploitation can lead to arbitrary code execution or other adverse effects, but the exact outcome is application-dependent [3]. The creation of a malicious object within the interpreter can corrupt internal state, alter logic flow, or trigger further security bypasses. References note that a malicious application may be able to execute arbitrary code with system privileges [1], indicating that in some contexts, this vulnerability can lead to full system compromise.

Mitigation and

Patch Status The vulnerability affects the JSON gem up to version 2.2.0 [3]. Users should upgrade to JSON gem version 2.3.0 or later, which includes a fix for this issue. Ruby versions 2.4.x, 2.5.x, and 2.6.x are all affected within the specified sub-versions [3]; upgrading the Ruby version (e.g., to 2.7.0 or later) or the JSON gem independently is recommended. Apple included a fix in macOS Big Sur 11.0.1, noting that the vulnerability could lead to arbitrary code execution [1]. No workaround is available other than updating the library.

References
  1. About the security content of macOS Big Sur 11.0.1 - Apple Support
  2. NVD - CVE-2020-10663

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
jsonRubyGems
< 2.3.02.3.0

Affected products

235

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

37

News mentions

0

No linked articles in our index yet.