{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-05T11:34:08.557","vulnerabilities":[{"cve":{"id":"CVE-2022-41875","sourceIdentifier":"security-advisories@github.com","published":"2022-11-23T19:15:12.197","lastModified":"2024-11-21T07:23:58.033","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE (remote code execution) on the attacked system running Optica. The vulnerability was patched in v. 0.10.2, where the call to the function `oj.load` was changed to `oj.safe_load`."},{"lang":"es","value":"Vulnerabilidad de ejecución remota de código (RCE) en Optica permite a atacantes no autenticados ejecutar código arbitrario a través de payloads JSON especialmente manipulados. Los payloads JSON especialmente manipulados pueden provocar RCE (ejecución remota de código) en el sistema atacado que ejecuta Optica. La vulnerabilidad se parchó en la versión 0.10.2, donde la llamada a la función `oj.load` se cambió a `oj.safe_load`."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:airbnb:optica:*:*:*:*:*:*:*:*","versionEndExcluding":"0.10.2","matchCriteriaId":"CE1AD149-693B-486D-9001-0A754E47E80A"}]}]}],"references":[{"url":"https://github.com/airbnb/optica/security/advisories/GHSA-cf87-4h6x-phh6","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/ohler55/oj/blob/develop/pages/Security.md","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://www.rubydoc.info/gems/oj/3.0.2/Oj.safe_load","source":"security-advisories@github.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/airbnb/optica/security/advisories/GHSA-cf87-4h6x-phh6","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/ohler55/oj/blob/develop/pages/Security.md","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.rubydoc.info/gems/oj/3.0.2/Oj.safe_load","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]}]}}]}