Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2020-10663 — HIGH severity vulnerability | Release Alert

CVE-2020-10663

7.5

HIGHCVSS v3

Published

April 28, 2020

CVSS v2

5 MEDIUM

Affected

28 projects

Assigned by

MITRE

Severity scale

010

Description

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

RubyGemsThis is a JSON implementation as a Ruby extension in C.

<= 2.2.0NVD

ChocolateyRuby is a dynamic, open source programming language focusing on simplicity and productivity. It has an elegant syntax that is natural to read and easy to write. This package provides a self-contained [Windows-based installer](https://rubyinstaller.org) that includes the Ruby language, an execution environment, important documentation, and more. ## Package Parameters - `/InstallDir` - Ruby installation directory, by default `c:\tools\RubyXY` where XY are major and minor version parts. - `/NoPath` - Do not add ruby bin folder to machine PATH. Example: `choco install ruby --package-parameters="'/NoPath ""/InstallDir:C:\your\install\path""'"` ## Notes - To install ruby development kit ruby installer provides `ridk` command. It provides an easy way to install msys2 via `ridk install 1`, however, the installation is interactive. To accomplish unattended install, use [msys2](https://chocolatey.org/packages/msys2) package.

>= 2.4.0, <= 2.4.9, >= 2.5.0, <= 2.5.7, >= 2.6.0, <= 2.6.5

More on this CVE

NVD↗GitHub Advisory↗

NVD

GitHubJSON implementation for Ruby

<= 2.2.0NVD

NPMa 'json' command for massaging and processing JSON on the command line

<= 2.2.0NVD

GitHubA "json" command for massaging JSON on your Unix command line.

<= 2.2.0NVD

GitHubpretty-printed JSON response middleware

<= 2.2.0NVD

NPMHundreds of open source icon sets in IconifyJSON format

<= 2.2.0NVD

NPM

>= 2.4.0, <= 2.4.9, >= 2.5.0, <= 2.5.7, >= 2.6.0, <= 2.6.5NVD

GitHub

<= 2.2.0NVD

NPMJSON format rendering components for deck.gl

<= 2.2.0NVD

@stoplight/json

NPMUseful functions when working with JSON.

<= 2.2.0NVD

@ts-common/json

NPMJSON Data Type

<= 2.2.0NVD

stoplightio/json

GitHubUseful functions when working with JSON.

<= 2.2.0NVD

@magic-libraries/json

NPM@magic json library. returns errors instead of throwing them. checks if output of stringify should error.

<= 2.2.0NVD

GitHubStrongly typed JSON library for Rust

<= 2.2.0NVD

magic-libraries/json

GitHubsimple json wrapper that returns errors instead of throwing them

<= 2.2.0NVD

GitHubThe Ruby Programming Language

>= 2.4.0, <= 2.4.9, >= 2.5.0, <= 2.5.7, >= 2.6.0, <= 2.6.5NVD

RubyGemsFIX ME

>= 2.4.0, <= 2.4.9, >= 2.5.0, <= 2.5.7, >= 2.6.0, <= 2.6.5NVD

Crates.ioPure Rust implementation of Ruby runtime environment

>= 2.4.0, <= 2.4.9, >= 2.5.0, <= 2.5.7, >= 2.6.0, <= 2.6.5NVD

NPMHelper methods from ruby ported to Node.

>= 2.4.0, <= 2.4.9, >= 2.5.0, <= 2.5.7, >= 2.6.0, <= 2.6.5NVD

Crates.ioJSON implementation in Rust

<= 2.2.0NVD

NuGet GalleryA JSON parser in C#, supporting dynamic deserialization in .NET 4.0

<= 2.2.0NVD

Docker HubOfficial openSUSE Leap Images

= 15.1NVD

Crates.ioBase library for interacting with Fedora web services

= 30, = 31NVD

Python Package IndexPlaceholder for the fedora name

= 30, = 31NVD

Docker HubOfficial Docker builds of Fedora

= 30, = 31NVD

NPMDigital Repository Ireland - fedora backend operations

= 30, = 31NVD

RubyGemsSet of capistrano recipies for automating creation of Fedora servers.

= 30, = 31NVD