Allele Security Alert
Command Injection Vulnerability
Aaron Patterson, Mike Dalessio
Aaron Patterson, Mike Dalessio, Yoko Harada, Timothy Elliott, John Shahid, Akinori MUSHA
Rexical gem versions v1.0.6 and earlier
Nokogiri gem versions 1.10.3 and earlier
Rexical gem version v1.0.7
Nokogiri gem version 1.10.4
Proof of concept
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby’s Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.
This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries.
Avoid calling the undocumented method Nokogiri::CSS::Tokenizer#load_file with untrusted user input.
Nokogiri security update v1.10.4
CVE-2019-5477 – Nokogiri Command Injection Vulnerability
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: August 24, 2019