Skip to content

[Aikido] Fix 1 critical issue in jmespath and 2 other issues#19

Open
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-22753085-5dzo
Open

[Aikido] Fix 1 critical issue in jmespath and 2 other issues#19
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-22753085-5dzo

Conversation

@aikido-autofix
Copy link
Copy Markdown

Targeted updates to remediate security findings while preserving existing behavior

Upgrade jmespath, rspec-its, and faraday to fix unsafe deserialization (RCE), private variable exposure, and thread-safety issues.

✅ 3 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2022-32511
🚨 CRITICAL
[jmespath] .rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
AIKIDO-2024-10421
MEDIUM
[rspec-its] A vulnerability allows unintended access to private or protected variables through public methods, exposing internal object states that should remain hidden and potentially compromising application security.
AIKIDO-2025-10223
LOW
[faraday] A thread safety vulnerability exists in the proxy option where the provided hash is mutated by adding keys, causing RuntimeError in multi-threaded environments. This issue allows attackers to trigger denial of service by exploiting unsafe hash modification in concurrent scenarios.

@aikido-autofix aikido-autofix Bot added the Kroo Label created by Aikido AutoFix label Apr 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Kroo Label created by Aikido AutoFix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants