Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-41875: Remote Code Execution in Optica

CVE-2022-41875 · published 3 years ago

Summary

A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE (remote code execution) on the attacked system running Optica. The vulnerability was patched in v. 0.1...

What to do

Update airbnb optica to version 0.10.2 or later.

Affected software

Vendor	Product	Affected versions
airbnb	optica	< 0.10.2 `cpe:2.3:a:airbnb:optica::::::::`

Original advisory text

Remote Code Execution in Optica

References

https://github.com/ohler55/oj/blob/develop/pages/Security.md URL
https://www.rubydoc.info/gems/oj/3.0.2/Oj.safe_load URL
https://github.com/airbnb/optica/security/advisories/GHSA-cf87-4h6x-phh6 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41875... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41875 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

10.0 Critical

Exploitation

2% chance of attack within 30 days

Type

CWE-502Deserialization of Untrusted Data

Timeline

Published23 Nov 2022

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2022-41875 · NVD

CVE-2022-41875 · OSV

GHSA-cf87-4h6x-phh6 · GHSA

Track software like this

Free during beta