Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."
CVSS Details
- CVSS 3.1 Base Score: 2.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-libsUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-default-gemsUpgrade ruby3.2Upgrade ruby3.2-docUpgrade ruby3.2-rubygem-typeprof | Aug 5, 2025 | Jul 20, 2025 |
| Debian | — | No solution exists | Jul 22, 2025 | Jul 20, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub