CVE-2019-5477

CRITICAL

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

Published: Aug 16, 2019 Modified: Jun 17, 2026

CWE-78 CWE-78

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (7)

Vendor	Product	Version
nokogiri	nokogiri	*
canonical	ubuntu_linux	16.04
canonical	ubuntu_linux	18.04
canonical	ubuntu_linux	19.04
canonical	ubuntu_linux	19.10
debian	debian_linux	8.0
debian	debian_linux	10.0

GitHub Security Advisory GHSA-cr5j-953j-xw5p

Nokogiri Command Injection Vulnerability

rubygems nokogiri < 1.10.4 Fixed: 1.10.4

rubygems rexical < 1.0.7 Fixed: 1.0.7

References (16)

https://github.com/sparklemotion/nokogiri/issues/1915 Patch, Third Party Advisory
https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc Release Notes
https://hackerone.com/reports/650835 Permissions Required
https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202006-05 Third Party Advisory
https://usn.ubuntu.com/4175-1/ Third Party Advisory
https://github.com/sparklemotion/nokogiri/issues/1915 Patch, Third Party Advisory
https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc Release Notes
https://hackerone.com/reports/650835 Permissions Required
https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202006-05 Third Party Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 5.90%

Top 7% most likely to be exploited

Threat Score 41 / 100

Data Sources

NVD EPSS GitHub