Critical severity9.8NVD Advisory· Published Jun 6, 2022· Updated Jun 17, 2026
CVE-2022-32511
CVE-2022-32511
Description
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
jmespathRubyGems | < 1.6.1 | 1.6.1 |
Affected products
22- jmespath.rb/jmespath.rbdescription
- osv-coords21 versionspkg:apk/chainguard/py3.10-jmespathpkg:apk/chainguard/py3.10-jmespath-binpkg:apk/chainguard/py3.11-jmespathpkg:apk/chainguard/py3.11-jmespath-binpkg:apk/chainguard/py3.12-jmespathpkg:apk/chainguard/py3.12-jmespath-binpkg:apk/chainguard/py3.13-jmespathpkg:apk/chainguard/py3.13-jmespath-binpkg:apk/chainguard/py3-jmespathpkg:apk/chainguard/py3-supported-jmespathpkg:apk/wolfi/py3.10-jmespathpkg:apk/wolfi/py3.10-jmespath-binpkg:apk/wolfi/py3.11-jmespathpkg:apk/wolfi/py3.11-jmespath-binpkg:apk/wolfi/py3.12-jmespathpkg:apk/wolfi/py3.12-jmespath-binpkg:apk/wolfi/py3.13-jmespathpkg:apk/wolfi/py3.13-jmespath-binpkg:apk/wolfi/py3-jmespathpkg:apk/wolfi/py3-supported-jmespathpkg:gem/jmespath
< 0+ 20 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 1.6.1
Patches
Vulnerability mechanics
References
11- github.com/jmespath/jmespath.rb/pull/55nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-5c5f-7vfq-3732ghsaADVISORY
- github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-32511ghsaADVISORY
- stackoverflow.com/a/30050571/580231nvdThird Party AdvisoryWEB
- github.com/jmespath/jmespath.rb/commit/e8841280053a9d9a0c90f36223f926c8b9e4ec49ghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/jmespath/CVE-2022-32511.ymlghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTPghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5ghsaWEB
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5/nvd
News mentions
0No linked articles in our index yet.