OS command injection in Nokogiri
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Nokogiri (ruby gem) | Fixed in v1.10.4 | — | No fix listed | CNA |
| — | nokogiri (RubyGems) | before 1.10.4 | 1.10.4 | Patch available | GHSA-cr5j-953j-xw5p |
| — | rexical (RubyGems) | before 1.0.7 | 1.0.7 | Patch available | GHSA-cr5j-953j-xw5p |
- Nokogiri (ruby gem) Vendor— Affected Fixed in v1.10.4 Fixed in — No fix listed CNA
- nokogiri (RubyGems) Vendor— Affected before 1.10.4 Fixed in 1.10.4 Patch available GHSA-cr5j-953j-xw5p
- rexical (RubyGems) Vendor— Affected before 1.0.7 Fixed in 1.0.7 Patch available GHSA-cr5j-953j-xw5p
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:* | up to 1.10.3 | Vulnerable | sparklemotion |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* | 19.10 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:* Versions up to 1.10.3 Vulnerable ·sparklemotion
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-cr5j-953j-xw5p nokogiri (RubyGems) Fixed in 1.10.4 Advisory →
- Fix · GHSA-cr5j-953j-xw5p rexical (RubyGems) Fixed in 1.0.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5477
- 2026-10-03 Alias added: GHSA-cr5j-953j-xw5p
References
Advisory 6
- [debian-lts-announce] 20190926 [SECURITY] [DLA 1933-1] ruby-nokogiri security update
- USN-4175-1
- GLSA-202006-05
- [debian-lts-announce] 20221012 [SECURITY] [DLA 3149-1] ruby-nokogiri security update
- [debian-lts-announce] 20221012 [SECURITY] [DLA 3150-1] rexical security update
- https://nvd.nist.gov/vuln/detail/CVE-2019-5477
Other 8
- https://hackerone.com/reports/650835
- https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc
- https://github.com/sparklemotion/nokogiri/commit/5d30128343573a9428c86efc758ba2c66e9f12dc
- https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5477.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexical/CVE-2019-5477.yml
- https://github.com/sparklemotion/nokogiri
- https://usn.ubuntu.com/4175-1
Sources
- CVE-2019-5477 · CVE Program
- CVE-2019-5477 · NVD
- FIRST EPSS
- GHSA-cr5j-953j-xw5p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences