Command injection in Rails https://github.com/rails/rails
Priority CRITICAL 85CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
Why it matters now
EPSS 0.8933 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Fixed railties (RubyGems): 5.2.2.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Rails | https://github.com/rails/rails | 5.2.2.1; 6.0.0.beta3 | — | No fix listed | CNA |
| — | railties (RubyGems) | 5.2.0 to before 5.2.2.1 | 5.2.2.1 | Patch available | GHSA-m42h-mh85-4qgc |
- https://github.com/rails/rails VendorRails Affected 5.2.2.1; 6.0.0.beta3 Fixed in — No fix listed CNA
- railties (RubyGems) Vendor— Affected 5.2.0 to before 5.2.2.1 Fixed in 5.2.2.1 Patch available GHSA-m42h-mh85-4qgc
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* | before 5.2.2.1 | Vulnerable | Rails |
| cpe:2.3:a:rubyonrails:rails:6.0.0:beta1:*:*:*:*:*:* | 6.0.0 beta1 | Vulnerable | Rails |
| cpe:2.3:a:rubyonrails:rails:6.0.0:beta2:*:*:*:*:*:* | 6.0.0 beta2 | Vulnerable | Rails |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
- cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* Versions before 5.2.2.1 Vulnerable ·Rails
- cpe:2.3:a:rubyonrails:rails:6.0.0:beta1:*:*:*:*:*:* Versions 6.0.0 beta1 Vulnerable ·Rails
- cpe:2.3:a:rubyonrails:rails:6.0.0:beta2:*:*:*:*:*:* Versions 6.0.0 beta2 Vulnerable ·Rails
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-m42h-mh85-4qgc railties (RubyGems) Fixed in 5.2.2.1 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Rails https://github.com/rails/rails — FEDORA-2019-1cfe24db5c
3 records Highest priority Priority CRITICAL 2 CRITICAL, 1 MEDIUM
Other records, highest priority first
- TI-2019-03828 Path traversal in Rails https://github.com/rails/railsPriority CRITICAL 90
- TI-2019-03829 Uncontrolled resource consumption in Rails https://github.com/rails/railsPriority MEDIUM 44
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5420
- 2026-10-03 Alias added: GHSA-m42h-mh85-4qgc
References
Exploit 2
Other 6
- https://groups.google.com/forum/#%21topic/rubyonrails-security/IsQKvDqZdKw
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/railties/CVE-2019-5420.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/IsQKvDqZdKw
- https://lists.fedoraproject.org/archives/list/[email protected]/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released
- https://www.exploit-db.com/exploits/46785
More Rails vulnerabilities
- TI-2014-00124 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the… KEVCVSS 3.1HIGH 7.5
- TI-2019-03828 Path traversal in Rails https://github.com/rails/rails KEVCVSS 3.1HIGH 7.5
- TI-2016-00672 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… KEVCVSS 3.1HIGH 7.5
- TI-2020-06581 Code injection in https://github.com/rails/rails CVSS 3.1HIGH 8.8
- TI-2013-00091 active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before… CVSS 2.0HIGH 7.5
- TI-2013-00263 lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x… CVSS 2.0HIGH 7.5
Sources
- CVE-2019-5420 · CVE Program
- CVE-2019-5420 · NVD
- FIRST EPSS
- GHSA-m42h-mh85-4qgc · GitHub Advisory Database · CC BY 4.0
- CVE-2019-5420 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences