TI-2021-04389 Aliases CVE-2021-21289 GHSA-qrqm-fpv6-6r8g

Command Injection Vulnerability in Mechanize

MEDIUM 42CWE-78Published 2021-02-02 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.

Summary

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.

Why it matters now

EPSS 0.03549 89th percentileScored 2026-11-07

Fix Partial mechanize (sparklemotion): 2.7.7mechanize (RubyGems): 2.7.7Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sparklemotion	mechanize	2.0 to before 2.7.7	2.7.7	Patch available	CNA
—	mechanize (RubyGems)	2.0.0 to before 2.7.7	2.7.7	Patch available	GHSA-qrqm-fpv6-6r8g

mechanize Vendorsparklemotion Affected 2.0 to before 2.7.7 Fixed in 2.7.7 Patch available CNA
mechanize (RubyGems) Vendor— Affected 2.0.0 to before 2.7.7 Fixed in 2.7.7 Patch available GHSA-qrqm-fpv6-6r8g

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:mechanize_project:mechanize::::::ruby::*	2.0 to before 2.7.7	Vulnerable	Mechanize Project
cpe:2.3:o:fedoraproject:fedora:32:::::::*	32	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:33:::::::*	33	Vulnerable	Fedoraproject
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian

cpe:2.3:a:mechanize_project:mechanize:*:*:*:*:*:ruby:*:* Versions 2.0 to before 2.7.7 Vulnerable ·Mechanize Project
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

Fix · CNA mechanize (sparklemotion) Fixed in 2.7.7
Fix · GHSA-qrqm-fpv6-6r8g mechanize (RubyGems) Fixed in 2.7.7 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat 3scale API Management Platform 2	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2021-21289
2026-10-03 Alias added: GHSA-qrqm-fpv6-6r8g

References

Patch 1

https://github.com/sparklemotion/mechanize/commit/66a6a1bfa653a5f13274a396a5e5441238656aa0

Advisory 8

Other 5

TI-2022-11724 Improper Handling of Unexpected Data Type in Nokogiri CVSS 3.1HIGH 8.2
TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5
TI-2026-69678 Mechanize leaks credential headers to other hosts after redirects CVSS 3.1MEDIUM 6.8
TI-2025-05895 sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow CVSS 4.0MEDIUM 4.8
TI-2025-05891 sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow CVSS 4.0MEDIUM 4.8
TI-2019-03885 OS command injection in Nokogiri CVSS 3.1CRITICAL 9.8

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences