Critical severity10.0NVD Advisory· Published Nov 23, 2022· Updated Jun 17, 2026

CVE-2022-41875

Description

A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE (remote code execution) on the attacked system running Optica. The vulnerability was patched in v. 0.10.2, where the call to the function oj.load was changed to oj.safe_load.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Airbnb/optica3 versions
cpe:2.3:a:airbnb:optica:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:airbnb:optica:*:*:*:*:*:*:*:*range: <0.10.2
- (no CPE)range: >0.10.2
- (no CPE)range: < 0.10.2

Patches

Vulnerability mechanics

References

github.com/airbnb/optica/security/advisories/GHSA-cf87-4h6x-phh6nvdThird Party Advisory
github.com/ohler55/oj/blob/develop/pages/Security.mdnvdThird Party Advisory
www.rubydoc.info/gems/oj/3.0.2/Oj.safe_loadnvdRelease NotesVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.650
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000