Read the docs
TI-2013-00110 Aliases CVE-2013-0175GHSA-pchc-949f-53m5

multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products…

Priority LOW 39CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.

Why it matters now

EPSS 0.03726 89th percentileScored 2026-11-07
Fix Fixed multi_xml (RubyGems): 0.5.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—multi_xml (RubyGems)before 0.5.20.5.2Patch availableGHSA-pchc-949f-53m5
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • multi_xml (RubyGems) Vendor— Affected before 0.5.2 Fixed in 0.5.2 Patch available GHSA-pchc-949f-53m5

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:erik_michaels-ober:multi_xml:0.5.2:*:*:*:*:*:*:*0.5.2VulnerableErik Michaels-ober
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*all versionsRunning onruby
cpe:2.3:a:grape_project:grape:0.1.0:*:*:*:*:*:*:*0.1.0VulnerableGrape Project
cpe:2.3:a:grape_project:grape:0.1.1:*:*:*:*:*:*:*0.1.1VulnerableGrape Project
cpe:2.3:a:grape_project:grape:0.1.2:*:*:*:*:*:*:*0.1.2VulnerableGrape Project
cpe:2.3:a:grape_project:grape:0.1.3:*:*:*:*:*:*:*0.1.3VulnerableGrape Project
cpe:2.3:a:grape_project:grape:0.1.4:*:*:*:*:*:*:*0.1.4VulnerableGrape Project
cpe:2.3:a:grape_project:grape:0.1.5:*:*:*:*:*:*:*0.1.5VulnerableGrape Project
cpe:2.3:a:grape_project:grape:0.2.0:*:*:*:*:*:*:*0.2.0VulnerableGrape Project
cpe:2.3:a:grape_project:grape:0.2.1:*:*:*:*:*:*:*0.2.1VulnerableGrape Project
  • cpe:2.3:a:erik_michaels-ober:multi_xml:0.5.2:*:*:*:*:*:*:* Versions 0.5.2 Vulnerable ·Erik Michaels-ober
  • cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* Versions all versions Running on ·ruby
  • cpe:2.3:a:grape_project:grape:0.1.0:*:*:*:*:*:*:* Versions 0.1.0 Vulnerable ·Grape Project
  • cpe:2.3:a:grape_project:grape:0.1.1:*:*:*:*:*:*:* Versions 0.1.1 Vulnerable ·Grape Project
  • cpe:2.3:a:grape_project:grape:0.1.2:*:*:*:*:*:*:* Versions 0.1.2 Vulnerable ·Grape Project
  • cpe:2.3:a:grape_project:grape:0.1.3:*:*:*:*:*:*:* Versions 0.1.3 Vulnerable ·Grape Project
  • cpe:2.3:a:grape_project:grape:0.1.4:*:*:*:*:*:*:* Versions 0.1.4 Vulnerable ·Grape Project
  • cpe:2.3:a:grape_project:grape:0.1.5:*:*:*:*:*:*:* Versions 0.1.5 Vulnerable ·Grape Project
  • cpe:2.3:a:grape_project:grape:0.2.0:*:*:*:*:*:*:* Versions 0.2.0 Vulnerable ·Grape Project
  • cpe:2.3:a:grape_project:grape:0.2.1:*:*:*:*:*:*:* Versions 0.2.1 Vulnerable ·Grape Project
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:grape_project:grape:0.2.2:*:*:*:*:*:*:*0.2.2VulnerableGrape Project
cpe:2.3:a:grape_project:grape:0.2.3:*:*:*:*:*:*:*0.2.3VulnerableGrape Project
cpe:2.3:a:grape_project:grape:0.2.4:*:*:*:*:*:*:*0.2.4VulnerableGrape Project
cpe:2.3:a:grape_project:grape:0.2.5:*:*:*:*:*:*:*0.2.5VulnerableGrape Project
  • cpe:2.3:a:grape_project:grape:0.2.2:*:*:*:*:*:*:* Versions 0.2.2 Vulnerable ·Grape Project
  • cpe:2.3:a:grape_project:grape:0.2.3:*:*:*:*:*:*:* Versions 0.2.3 Vulnerable ·Grape Project
  • cpe:2.3:a:grape_project:grape:0.2.4:*:*:*:*:*:*:* Versions 0.2.4 Vulnerable ·Grape Project
  • cpe:2.3:a:grape_project:grape:0.2.5:*:*:*:*:*:*:* Versions 0.2.5 Vulnerable ·Grape Project

Remediation

  • Fix · GHSA-pchc-949f-53m5 multi_xml (RubyGems) Fixed in 0.5.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-0175
  2. 2026-10-03 Alias added: GHSA-pchc-949f-53m5

References

Advisory 1

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences