The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ruby-json | Jul 30, 2024 | Feb 13, 2013 |
| Freebsd | — | Upgrade rubygem19-json_pureUpgrade rubygem18-jsonUpgrade rubygem19-jsonUpgrade rubyUpgrade rubygem18-json_pure | Dec 10, 2025 | Feb 16, 2013 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Feb 12, 2013 |
| Suse | — | Upgrade rubygem-json_pureUpgrade ruby-debuginfoUpgrade ruby19-tkUpgrade rubyUpgrade ruby19Upgrade ruby-tk-debuginfoUpgrade ruby19-develUpgrade ruby-doc-htmlUpgrade ruby-debugsourceUpgrade ruby19-doc-riUpgrade ruby-develUpgrade ruby-commonUpgrade ruby-tkUpgrade ruby-test-suiteUpgrade sle-sdk-releaseUpgrade ruby-doc-riUpgrade ruby-examplesUpgrade ruby19-devel-extra | Feb 17, 2015 | Feb 12, 2013 |
| Ubuntu | — | Upgrade ruby1.9.1Upgrade libruby1.9.1 | Nov 8, 2024 | Feb 13, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub