Read the docs
TI-2011-04622 Aliases CVE-2011-10019GHSA-97vm-c39p-jr86

Spreecommerce < 0.60.2 Search Parameter RCE

Priority MEDIUM 58CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.06252 93rd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix Fixed Spreecommerce (Spreecommerce): 0.60.2spree (RubyGems): 0.60.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
spreeSpreecommercebefore 0.60.20.60.2Patch availableCNA
—spree (RubyGems)before 0.60.20.60.2Patch availableGHSA-97vm-c39p-jr86
  • Spreecommerce Vendorspree Affected before 0.60.2 Fixed in 0.60.2 Patch available CNA
  • spree (RubyGems) Vendor— Affected before 0.60.2 Fixed in 0.60.2 Patch available GHSA-97vm-c39p-jr86

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*before 0.60.2Vulnerablespree
  • cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:* Versions before 0.60.2 Vulnerable ·spree

Remediation

  • Fix · CNA Spreecommerce (Spreecommerce) Fixed in 0.60.2
  • Fix · GHSA-97vm-c39p-jr86 spree (RubyGems) Fixed in 0.60.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-10019
  2. 2026-10-03 Alias added: GHSA-97vm-c39p-jr86

References

Exploit 2

Patch 1

Advisory 1

Other 4

  • TI-2011-04629 Spreecommerce < 0.50.x API RCE CVSS 4.0CRITICAL 9.3
  • TI-2026-18150 Spree API has Unauthenticated IDOR - Guest Address CVSS 3.1HIGH 7.5
  • TI-2026-18149 Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification CVSS 3.1MEDIUM 6.5
  • TI-2026-20825 Spree allows unauthenticated users can access all guest addresses CVSS 4.0HIGH 7.7
  • TI-2026-20824 Unauthenticated Spree Commerce users can view completed guest orders by Order ID CVSS 4.0HIGH 7.7
  • TI-2020-16044 Authorization bypass in Spree CVSS 3.1HIGH 7.7
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences