CVE-2022-32511.yml

---
gem: jmespath
cve: 2022-32511
ghsa: 5c5f-7vfq-3732
url: https://github.com/jmespath/jmespath.rb/pull/55
title: JMESPath for Ruby using JSON.load instead of JSON.parse
date: 2022-06-07
description: |
  jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a
  situation where JSON.parse is preferable.
cvss_v3: 9.8
patched_versions:
  - ">= 1.6.1"
related:
  url:
    - https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
    - https://stackoverflow.com/a/30050571/580231