cve.bz

CVE-2020-10663

7.5 highEPSS 6.8%

High (7.5). EPSS 6.8% chance of exploitation in the next 30 days. Fixed in json 2.3.0.

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
6.8% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE
CWE-20
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-jphg-qwrw-7w9gRubyGemsjson<2.3.02.3.0

References

Check your stackJSON