GitHub Advisoryadvisory · RubyGems

GHSA-cr5j-953j-xw5p Nokogiri Command Injection Vulnerability

CRITICAL Published 2019-08-19 Modified 2023-08-28 Official page ↗
Aliases
CVE-2019-5477
Ecosystem
RubyGems
Packages
nokogiri, rexical
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2019-08-19

Affected packages

• RubyGems nokogiri: < 1.10.4 → fixed in 1.10.4 • RubyGems rexical: < 1.0.7 → fixed in 1.0.7

Description

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

Related

Alias · CVE (1)

  • CVE-2019-5477 A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open`… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References