From 3b59a6d8743454dcc30712cf8ed89582ed80ab36 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:25:01 -0400
Subject: [PATCH] Updated jmespatch advisory with new data

---
 gems/jmespath/CVE-2022-32511.yml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/gems/jmespath/CVE-2022-32511.yml b/gems/jmespath/CVE-2022-32511.yml
index 3a73376b17..059dad9051 100644
--- a/gems/jmespath/CVE-2022-32511.yml
+++ b/gems/jmespath/CVE-2022-32511.yml
@@ -2,16 +2,27 @@
 gem: jmespath
 cve: 2022-32511
 ghsa: 5c5f-7vfq-3732
-url: https://github.com/jmespath/jmespath.rb/pull/55
+url: https://nvd.nist.gov/vuln/detail/CVE-2022-32511
 title: JMESPath for Ruby using JSON.load instead of JSON.parse
 date: 2022-06-07
 description: |
   jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a
   situation where JSON.parse is preferable.
+cvss_v2: 7.5
 cvss_v3: 9.8
 patched_versions:
   - ">= 1.6.1"
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-32511
+    - https://github.com/jmespath/jmespath.rb/blob/main/CHANGELOG.md#161-2022-03-07
     - https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
+    - https://github.com/jmespath/jmespath.rb/pull/55
+    - https://github.com/jmespath/jmespath.rb/commit/e8841280053a9d9a0c90f36223f926c8b9e4ec49
     - https://stackoverflow.com/a/30050571/580231
+    - https://github.com/advisories/GHSA-5c5f-7vfq-3732
+notes: |
+  - cvss_v3 from GHSA and nvd.nist.gov
+  - cvss_v2 from nvd.nist.gov
+  - This is under the AWS/Amazon Security policy
+  - Release 1.6.2 (2022-11-25) was last release.