Read the docs
TI-2020-06548 Aliases CVE-2020-8130GHSA-jppv-gw3r-w3q8

OS command injection in https://github.com/ruby/ruby

Priority LOW 31CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.

Summary

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.

Why it matters now

EPSS 0.01359 71st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial rake (RubyGems): 12.3.3Red Hat: 1 advisoryRed Hat: 2 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—https://github.com/ruby/rubyFixed in Rake 12.3.3—No fix listedCNA
—rake (RubyGems)before 12.3.312.3.3Patch availableGHSA-jppv-gw3r-w3q8
  • https://github.com/ruby/ruby Vendor— Affected Fixed in Rake 12.3.3 Fixed in — No fix listed CNA
  • rake (RubyGems) Vendor— Affected before 12.3.3 Fixed in 12.3.3 Patch available GHSA-jppv-gw3r-w3q8

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:rake:*:*:*:*:*:*:*:*before 12.3.3Vulnerableruby
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*19.10VulnerableCanonical
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
  • cpe:2.3:a:ruby-lang:rake:*:*:*:*:*:*:*:* Versions before 12.3.3 Vulnerable ·ruby
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE

Remediation

  • Fix · GHSA-jppv-gw3r-w3q8 rake (RubyGems) Fixed in 12.3.3 Advisory →

Red Hat 1 advisory

  • RHSA-2021:4702 Released 2021-11-16 · Red Hat rating Moderate
    Satellite 6.10 Release
    • Red Hat Satellite 6.10 candlepin-4.0.9-1.el7sat, foreman-2.5.2.17-2.el7sat, python-aiohttp-3.7.4-1.el7pc +14
    • Red Hat Satellite Capsule 6.10 foreman-2.5.2.17-2.el7sat, python-aiohttp-3.7.4-1.el7pc, python-ecdsa-0.13.3-2.el7pc +9

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5AffectedNo fix yet: Fix deferred
Red Hat Storage 3AffectedNo fix yet: Fix deferred
Red Hat Satellite 6.10Fixed RHSA-2021:4702
Red Hat Satellite Capsule 6.10Fixed RHSA-2021:4702
Not affected: 4 products
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat Satellite 6.10
  • Red Hat Satellite Capsule 6.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8130
  2. 2026-10-03 Alias added: GHSA-jppv-gw3r-w3q8

References

Exploit 1

Advisory 7

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences