What is CVE-2022-41875?

CVE-2022-41875 is a critical-severity vulnerability in Airbnb Optica, classified under Deserialization of Untrusted Data. CVSS score: 10.0/10. Published 2022-11-23.

How severe is CVE-2022-41875?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Deserialization in Airbnb Optica

CVE-2022-41875

A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE (remote code execution) on the attacked system running Optica. The vulnerability was patched in v. 0.10.2, where the call to the function `oj.load` was changed to `oj.safe_load`.

Vulnerability class: Insecure Deserialization

Published 2022-11-23 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.017 (76.8th percentile), scored 2026-10-02.

Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 76.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.016 · newest: 0.017 · change: +0.001

Affected products

Airbnb Optica — versions < 0.10.2

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

github.com/airbnb/optica/security/advisories/GHSA-cf87-4h6x-phh6 (Third Party Advisory)
github.com/ohler55/oj/blob/develop/pages/Security.md (Third Party Advisory)
www.rubydoc.info/gems/oj/3.0.2/Oj.safe_load (Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2022-41875?: CVE-2022-41875 is a critical-severity vulnerability in Airbnb Optica, classified under Deserialization of Untrusted Data. CVSS score: 10.0/10. Published 2022-11-23.
How severe is CVE-2022-41875?: Critical severity. CVSS v3 base score is 10.0 out of 10.