CVE-2022-32511 (jmespath): JMESPath for Ruby using JSON.load instead of JSON.parse

June 7th, 2022

CVSS v3.x: 9.8 (Critical)

jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.

RubySec