CVE-2022-41875 CRITICAL

CVE-2022-41875: Remote Code Execution in Optica

Vendor Airbnb
Product optica
Weakness CWE-502 · Unsafe deserialization
Published November 23, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE (remote code execution) on the attacked system running Optica. The vulnerability was patched in v. 0.10.2, where the call to the function `oj.load` was changed to `oj.safe_load`.

Key dates

02Disclosure timeline

November 23, 2022 CVE published
April 23, 2025 Record updated