CVE-2019-5477

CRITICAL EPSS 92.3%
Published Aug 16, 20196y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Aug 16, 2019 6y ago
Last Modified Jun 17, 2026 2w ago

Description

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
92.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-78 OS Command Injection Injection

Affected Products 7

VendorProductVersionRange
nokogirinokogiri* ≤1.10.3
canonicalubuntu_linux16.04any
canonicalubuntu_linux18.04any
canonicalubuntu_linux19.04any
canonicalubuntu_linux19.10any
debiandebian_linux8.0any
debiandebian_linux10.0any

References 8

  • github.com https://github.com/sparklemotion/nokogiri/issues/1915
    PatchThird Party Advisory
  • github.com https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc
    Release Notes
  • hackerone.com https://hackerone.com/reports/650835
    Permissions Required
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html
    Mailing ListThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html
    Mailing ListThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html
    Mailing ListThird Party Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/202006-05
    Third Party Advisory
  • usn.ubuntu.com https://usn.ubuntu.com/4175-1/
    Third Party Advisory

Remediation

  • github.com https://github.com/sparklemotion/nokogiri/issues/1915
    PatchThird Party Advisory