Every CVE Search/ Get API key

CVE-2013-0269

JSON gem has Improper Input Validation vulnerability

7.5 HighPublic exploitFix available

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

Exploit likelihood

13.9%Down 23.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

Record
CVE-2013-0269
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

Record
CVE-2013-0269
Updated
2026-11-02
EUVDEUVD-2017-0327 No score

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

Record
EUVD-2017-0327
Updated
2026-11-03
GitHub AdvisoriesGHSA-x457-cw4h-hq5f No score

JSON gem has Improper Input Validation vulnerability

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

Record
GHSA-x457-cw4h-hq5f
Weakness
CWE-20
Updated
2026-11-02
OSVRHSA-2013:0701 5.4

Red Hat Security Advisory: ruby193-ruby, rubygem-json and rubygem-rdoc security update

Record
RHSA-2013:0701
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSV No score

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

Record
CVE-2013-0269
Updated
2026-11-02
OSVDEBIAN-CVE-2013-0269 No score

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

Record
DEBIAN-CVE-2013-0269
Updated
2026-11-02
OSVGHSA-x457-cw4h-hq5f No score

JSON gem has Improper Input Validation vulnerability

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

Record
GHSA-x457-cw4h-hq5f
Weakness
CWE-20
Updated
2026-11-02
OSVUBUNTU-CVE-2013-0269 No score

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

Record
UBUNTU-CVE-2013-0269
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
json
RubyGems
 before 1.5.5
1.5.5
json
RubyGems
 1.6.0 up to 1.6.8
1.6.8
json
RubyGems
 1.7.0 up to 1.7.7
1.7.7
ruby-json
Debian:12
 before 1.7.3-3
1.7.3-3
ruby-json
Debian:13
 before 1.7.3-3
1.7.3-3
ruby-json
Debian:14
 before 1.7.3-3
1.7.3-3
libjson-ruby
Debian:6.0
 before 1.1.9-1+deb6u1, plus listed versions
1.1.9-1
1.1.9-1+deb6u1
ruby1.9.1
Debian:6.0
From an advisory covering 2 CVEs
 before 1.9.2.0-2+deb6u5, plus listed versions
1.9.2.0-21.9.2.0-2+armhf
1.9.2.0-2+deb6u5
json
RubyGems
 before 1.5.5, plus listed versions
0.4.00.4.10.4.20.4.31.0.0
Show 31 moreShow less
1.0.11.0.21.0.31.0.41.1.01.1.11.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.91.2.01.2.11.2.21.2.31.2.41.4.01.4.11.4.21.4.31.4.41.4.51.4.61.5.01.5.11.5.21.5.31.5.4
1.5.5
json
RubyGems
 1.6.0 up to 1.6.8, plus listed versions
1.6.0.11.6.11.6.21.6.31.6.41.6.51.6.61.6.7
1.6.8
Show 21 moreShow less
Affected packages
PackageAffectedFixed
json
RubyGems
 1.7.0 up to 1.7.7, plus listed versions
1.7.11.7.21.7.31.7.41.7.51.7.6
1.7.7
ruby193-ruby
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.9.3.327-28.el6
0:1.9.3.327-28.el6
ruby193-ruby-debuginfo
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.9.3.327-28.el6
0:1.9.3.327-28.el6
ruby193-ruby-devel
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.9.3.327-28.el6
0:1.9.3.327-28.el6
ruby193-ruby-doc
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.9.3.327-28.el6
0:1.9.3.327-28.el6
ruby193-ruby-irb
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.9.3.327-28.el6
0:1.9.3.327-28.el6
ruby193-ruby-libs
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.9.3.327-28.el6
0:1.9.3.327-28.el6
ruby193-ruby-tcltk
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.9.3.327-28.el6
0:1.9.3.327-28.el6
ruby193-rubygem-bigdecimal
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.1.0-28.el6
0:1.1.0-28.el6
ruby193-rubygem-io-console
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:0.3-28.el6
0:0.3-28.el6
ruby193-rubygem-json
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.5.4-28.el6
0:1.5.4-28.el6
ruby193-rubygem-minitest
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:2.5.1-28.el6
0:2.5.1-28.el6
ruby193-rubygem-rake
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:0.9.2.2-28.el6
0:0.9.2.2-28.el6
ruby193-rubygem-rdoc
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:3.9.4-28.el6
0:3.9.4-28.el6
ruby193-rubygems
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.8.23-28.el6
0:1.8.23-28.el6
ruby193-rubygems-devel
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.8.23-28.el6
0:1.8.23-28.el6
rubygem-json
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.7.3-2.el6op
0:1.7.3-2.el6op
rubygem-json-debuginfo
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.7.3-2.el6op
0:1.7.3-2.el6op
rubygem-json-doc
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:1.7.3-2.el6op
0:1.7.3-2.el6op
rubygem-rdoc
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:3.8-9.el6op
0:3.8-9.el6op
rubygem-rdoc-doc
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
 before 0:3.8-9.el6op
0:3.8-9.el6op

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubheroku/heroku-CVE-2013-02692013-02-11

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-0269 is a high vulnerability (CVSS 7.5) in Rubygems Json Gem, published February 12, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.9%, the 96th percentile. Fixed in json 1.5.5.

References

Show 40 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open