CVE-2022-41875

CRITICAL 9.8CVE-2022-41875 · Published 23/11/2022 · updated 17/06/2026

In short

CVE-2022-41875 is a CRITICAL (CVSS 9.8) vulnerability affecting optica (airbnb).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.3% of all vulnerabilities.
Fix: update to 0.10.2 or later.

Package	Affected versions	Patched versions
optica airbnb	`< 0.10.2`	`0.10.2`

Description

A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE (remote code execution) on the attacked system running Optica. The vulnerability was patched in v. 0.10.2, where the call to the function `oj.load` was changed to `oj.safe_load`.

References

airbnb/optica security advisory · Third Party Advisory
ohler55/oj · Third Party Advisory
rubydoc.info/gems/oj/3.0.2/Oj.safe_load · Release Notes

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free