Read the docs
TI-2013-01588 Aliases CVE-2013-1802GHSA-9h36-4jf2-hx53

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string…

Priority LOW 39CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-264, CWE-704 and the CVSS impact.

Summary

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.

Why it matters now

EPSS 0.03415 88th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed extlib (RubyGems): 0.9.16

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—extlib (RubyGems)before 0.9.160.9.16Patch availableGHSA-9h36-4jf2-hx53
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • extlib (RubyGems) Vendor— Affected before 0.9.16 Fixed in 0.9.16 Patch available GHSA-9h36-4jf2-hx53

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:dan_kubb:extlib:*:*:*:*:*:*:*:*up to 0.9.15VulnerableDan Kubb
cpe:2.3:a:dan_kubb:extlib:0.9.2:*:*:*:*:*:*:*0.9.2VulnerableDan Kubb
cpe:2.3:a:dan_kubb:extlib:0.9.3:*:*:*:*:*:*:*0.9.3VulnerableDan Kubb
cpe:2.3:a:dan_kubb:extlib:0.9.4:*:*:*:*:*:*:*0.9.4VulnerableDan Kubb
cpe:2.3:a:dan_kubb:extlib:0.9.5:*:*:*:*:*:*:*0.9.5VulnerableDan Kubb
cpe:2.3:a:dan_kubb:extlib:0.9.6:*:*:*:*:*:*:*0.9.6VulnerableDan Kubb
cpe:2.3:a:dan_kubb:extlib:0.9.7:*:*:*:*:*:*:*0.9.7VulnerableDan Kubb
cpe:2.3:a:dan_kubb:extlib:0.9.8:*:*:*:*:*:*:*0.9.8VulnerableDan Kubb
cpe:2.3:a:dan_kubb:extlib:0.9.9:*:*:*:*:*:*:*0.9.9VulnerableDan Kubb
cpe:2.3:a:dan_kubb:extlib:0.9.10:*:*:*:*:*:*:*0.9.10VulnerableDan Kubb
  • cpe:2.3:a:dan_kubb:extlib:*:*:*:*:*:*:*:* Versions up to 0.9.15 Vulnerable ·Dan Kubb
  • cpe:2.3:a:dan_kubb:extlib:0.9.2:*:*:*:*:*:*:* Versions 0.9.2 Vulnerable ·Dan Kubb
  • cpe:2.3:a:dan_kubb:extlib:0.9.3:*:*:*:*:*:*:* Versions 0.9.3 Vulnerable ·Dan Kubb
  • cpe:2.3:a:dan_kubb:extlib:0.9.4:*:*:*:*:*:*:* Versions 0.9.4 Vulnerable ·Dan Kubb
  • cpe:2.3:a:dan_kubb:extlib:0.9.5:*:*:*:*:*:*:* Versions 0.9.5 Vulnerable ·Dan Kubb
  • cpe:2.3:a:dan_kubb:extlib:0.9.6:*:*:*:*:*:*:* Versions 0.9.6 Vulnerable ·Dan Kubb
  • cpe:2.3:a:dan_kubb:extlib:0.9.7:*:*:*:*:*:*:* Versions 0.9.7 Vulnerable ·Dan Kubb
  • cpe:2.3:a:dan_kubb:extlib:0.9.8:*:*:*:*:*:*:* Versions 0.9.8 Vulnerable ·Dan Kubb
  • cpe:2.3:a:dan_kubb:extlib:0.9.9:*:*:*:*:*:*:* Versions 0.9.9 Vulnerable ·Dan Kubb
  • cpe:2.3:a:dan_kubb:extlib:0.9.10:*:*:*:*:*:*:* Versions 0.9.10 Vulnerable ·Dan Kubb
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:dan_kubb:extlib:0.9.11:*:*:*:*:*:*:*0.9.11VulnerableDan Kubb
cpe:2.3:a:dan_kubb:extlib:0.9.12:*:*:*:*:*:*:*0.9.12VulnerableDan Kubb
cpe:2.3:a:dan_kubb:extlib:0.9.13:*:*:*:*:*:*:*0.9.13VulnerableDan Kubb
cpe:2.3:a:dan_kubb:extlib:0.9.14:*:*:*:*:*:*:*0.9.14VulnerableDan Kubb
  • cpe:2.3:a:dan_kubb:extlib:0.9.11:*:*:*:*:*:*:* Versions 0.9.11 Vulnerable ·Dan Kubb
  • cpe:2.3:a:dan_kubb:extlib:0.9.12:*:*:*:*:*:*:* Versions 0.9.12 Vulnerable ·Dan Kubb
  • cpe:2.3:a:dan_kubb:extlib:0.9.13:*:*:*:*:*:*:* Versions 0.9.13 Vulnerable ·Dan Kubb
  • cpe:2.3:a:dan_kubb:extlib:0.9.14:*:*:*:*:*:*:* Versions 0.9.14 Vulnerable ·Dan Kubb

Remediation

  • Fix · GHSA-9h36-4jf2-hx53 extlib (RubyGems) Fixed in 0.9.16 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-1802
  2. 2026-10-03 Alias added: GHSA-9h36-4jf2-hx53

References

Exploit 1

Advisory 2

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences