TI-2022-13159 Aliases CVE-2022-31115 GHSA-977c-63xq-cgw3

Unsafe YAML deserialization in opensearch-ruby

HIGH 73CWE-502Published 2022-06-30 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby `YAML.load` function was used instead of `YAML.safe_load`. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response is of type YAML. An attacker must be in control of an opensearch server and convince the victim to connect to it in order to exploit this vulnerability. The problem has been patched in opensearch-ruby gem version 2.0.1. Users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01617 76th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed opensearch-ruby (opensearch-project): 2.0.1opensearch-ruby (RubyGems): 2.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
AWS	opensearch-ruby	before 2.0.1	2.0.1	Patch available	CNA
—	opensearch-ruby (RubyGems)	2.0.0 to before 2.0.2	2.0.2	Patch available	GHSA-977c-63xq-cgw3

opensearch-ruby VendorAWS Affected before 2.0.1 Fixed in 2.0.1 Patch available CNA
opensearch-ruby (RubyGems) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-977c-63xq-cgw3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:amazon:opensearch::::::ruby::*	before 2.0.2	Vulnerable	AWS

cpe:2.3:a:amazon:opensearch:*:*:*:*:*:ruby:*:* Versions before 2.0.2 Vulnerable ·AWS

Remediation

Fix · CNA opensearch-ruby (opensearch-project) Fixed in 2.0.1
Fix · GHSA-977c-63xq-cgw3 opensearch-ruby (RubyGems) Fixed in 2.0.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-31115
2026-10-03 Alias added: GHSA-977c-63xq-cgw3

References

Exploit 1

https://staaldraad.github.io/post/2021-01-09-universal-rce-ruby-yaml-load-updated/

Patch 1

https://github.com/opensearch-project/opensearch-ruby/pull/77

Advisory 2

Other 5

TI-2025-08817 OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS CVSS 4.0HIGH 8.3
TI-2022-16405 OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information CVSS 3.1HIGH 7.5
TI-2023-09441 Issue with whitespace in JWT roles in OpenSearch CVSS 3.1HIGH 8.8
TI-2023-11077 Time discrepancy in authentication responses in OpenSearch CVSS 3.1MEDIUM 5.3
TI-2023-09442 Field-level security issue with .keyword fields in OpenSearch CVSS 3.1MEDIUM 6.5
TI-2022-20259 Issue with fine-grained access control of indices backing data streams CVSS 3.1MEDIUM 6.3

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences