jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/jmespath/jmespath.rb/pull/55 Patch, Third Party Advisory
- https://github.com/jmespath/jmespath.rb/pull/55 Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · jmespath, fedoraprojectNVD modified 2026-10-08 22:17
Affected (CPE criteria) 3
cpe:2.3:a:jmespath:jmespath:*:*:*:*:*:ruby:*:*cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
References 10
- https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1 Third Party Advisory
- https://github.com/jmespath/jmespath.rb/pull/55 Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5/
- https://stackoverflow.com/a/30050571/580231 Third Party Advisory
- https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1 Third Party Advisory
- https://github.com/jmespath/jmespath.rb/pull/55 Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5/
- https://stackoverflow.com/a/30050571/580231 Third Party Advisory