CVEvulnerability

CVE-2022-41875

9.8 CRITICAL Published 2022-11-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-11-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502

Description

A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE (remote code execution) on the attacked system running Optica. The vulnerability was patched in v. 0.10.2, where the call to the function `oj.load` was changed to `oj.safe_load`.

Affected configurations

• airbnb optica (< 0.10.2)

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References