Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

RubyGems allows malicious output to be displayed to users

CVE-2019-8321 · published 7 years ago
Summary

RubyGems, a package manager for Ruby, has a security issue that could allow an attacker to display misleading or malicious information to users. This could potentially confuse users and undermine trust in the package manager. To protect yourself, update to the latest version of RubyGems.

What to do
  • Update jim weirich rubygems-update to version 2.7.9.
  • Update jim weirich rubygems-update to version 3.0.2.
Affected software
Ecosystem VendorProductAffected versions
rubygems jim weirich rubygems-update >= 2.6.0, < 2.7.9
>= 3.0.0, < 3.0.2
Fix: upgrade to 2.7.9
– rubygems rubygems >= 2.6.0, <= 3.0.2
cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*
– debian debian_linux 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
– opensuse leap 15.0
15.1
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
Original advisory text
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published17 Jun 2019
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-fr32-gr5c-xq5c · GHSA
CVE-2019-8321 · NVD
Track software like this
Free during beta