Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticated attacker can craft the ___cfduid cookie value with base64 arbitrary code to be executed via eval(), which can be leveraged to execute arbitrary code on the target system. Note that there are three underscore characters in the cookie name. This is unrelated to the __cfduid cookie that is legitimately used by Cloudflare.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | bootstrap-sass (RubyGems) | 3.2.0.3 to before 3.2.0.4 | 3.2.0.4 | Patch available | GHSA-vqqv-v9m2-48p2 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- bootstrap-sass (RubyGems) Vendor— Affected 3.2.0.3 to before 3.2.0.4 Fixed in 3.2.0.4 Patch available GHSA-vqqv-v9m2-48p2
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:getbootstrap:bootstrap-sass:3.2.0.3:*:*:*:*:ruby:*:* | 3.2.0.3 | Vulnerable | Getbootstrap |
- cpe:2.3:a:getbootstrap:bootstrap-sass:3.2.0.3:*:*:*:*:ruby:*:* Versions 3.2.0.3 Vulnerable ·Getbootstrap
Remediation
- Fix · GHSA-vqqv-v9m2-48p2 bootstrap-sass (RubyGems) Fixed in 3.2.0.4 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 1 product
- CloudForms Management Engine 5
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10842
- 2026-10-03 Alias added: GHSA-vqqv-v9m2-48p2
References
Advisory 3
Sources
- CVE-2019-10842 · CVE Program
- CVE-2019-10842 · NVD
- FIRST EPSS
- GHSA-vqqv-v9m2-48p2 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-10842 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences