jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable. References https://nvd.nist.gov/vuln/detail/CVE-2022-32511 https://github.com/jmespath/jmespath.rb/pull/55 https://github.com/jmespath/jmespath.rb/compare/v1.6.0…v1.6.1 https://stackoverflow.com/a/30050571/580231 https://github.com/advisories/GHSA-5c5f-7vfq-3732