CVE catalog

CVE-2019-5477

ruby-nokogiri: CVE-2019-5477

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
5.90% · Oct 27, 2026

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrexicalsid1.0.8-1fixed
Debianrexicalforky1.0.8-1fixed
Debianrexicaltrixie1.0.7-2fixed
Debianrexicalbookworm1.0.7-2fixed
Debianruby-nokogirisid1.19.4+dfsg-1fixed
Debianruby-nokogiriforky1.19.4+dfsg-1fixed
Debianruby-nokogiritrixie1.18.2+dfsg-1fixed
Debianruby-nokogiribookworm1.13.10+dfsg-2fixed
Ubunturuby-nokogiri16.041.6.6.2+ds-2build2vulnerable
Ubunturuby-nokogiri16.041.6.6.3-1vulnerable
Ubunturuby-nokogiri16.041.6.7-1vulnerable
Ubunturuby-nokogiri16.041.6.7.1-1vulnerable
Ubunturuby-nokogiri16.041.6.7.2-3vulnerable
Ubunturuby-nokogiri16.041.6.7.2-3build1vulnerable
Ubunturuby-nokogiri16.041.6.7.2-3ubuntu0.1fixed
Ubunturuby-nokogiri18.041.8.0-1vulnerable
Ubunturuby-nokogiri18.041.8.1-1vulnerable
Ubunturuby-nokogiri18.041.8.1-1build1vulnerable
Ubunturuby-nokogiri18.041.8.2-1build1vulnerable
Ubunturuby-nokogiri18.041.8.2-1ubuntu0.1fixed
Suserubygem-nokogiriopenstack cloud 71.6.1-5.3.1fixed
Suserubygem-nokogiriopenstack cloud crowbar 81.6.1-5.3.1fixed
Suserubygem-nokogiriopenstack cloud crowbar 91.6.1-5.3.1fixed
Ubunturuby-nokogiripro1.5.9-2vulnerable
Ubunturuby-nokogiripro1.5.9-3vulnerable
Ubunturuby-nokogiripro1.6.0-1vulnerable
Ubunturuby-nokogiripro1.6.1+ds-1vulnerable
Ubunturuby-nokogiripro1.6.1+ds-1ubuntu0.1~esm1fixed
Ubunturuby-nokogiri16.041.6.6.2+ds-2build2vulnerable
Ubunturuby-nokogiri16.041.6.6.3-1vulnerable
Ubunturuby-nokogiri16.041.6.7-1vulnerable
Ubunturuby-nokogiri16.041.6.7.1-1vulnerable
Ubunturuby-nokogiri16.041.6.7.2-3vulnerable
Ubunturuby-nokogiri16.041.6.7.2-3build1vulnerable
Ubunturuby-nokogiri16.041.6.7.2-3ubuntu0.1fixed
Ubunturuby-nokogiri18.041.8.0-1vulnerable
Ubunturuby-nokogiri18.041.8.1-1vulnerable
Ubunturuby-nokogiri18.041.8.1-1build1vulnerable
Ubunturuby-nokogiri18.041.8.2-1build1vulnerable
Ubunturuby-nokogiri18.041.8.2-1ubuntu0.1fixed
Suserubygem-nokogirilinux enterprise high availability extension 151.8.5-3.6.1fixed
Suserubygem-nokogirilinux enterprise high availability extension 15 sp11.8.5-3.6.1fixed
Suserubygem-nokogirilinux enterprise high availability extension 15 sp21.8.5-3.6.1fixed
Opensuserubygem-nokogirileap 15.21.8.5-lp152.4.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrexicalsourcesid1.0.7-1not yet assignedNot reported[940905]
Debianrexicalsourceforky1.0.7-1not yet assignedNot reported[940905]
Debianrexicalsourcetrixie1.0.7-1not yet assignedNot reported[940905]
Debianrexicalsourcebookworm1.0.7-1not yet assignedNot reported[940905]
Debianruby-nokogirisourcesid1.10.4+dfsg1-1not yet assignedNot reported[934802]
Debianruby-nokogirisourceforky1.10.4+dfsg1-1not yet assignedNot reported[934802]
Debianruby-nokogirisourcetrixie1.10.4+dfsg1-1not yet assignedNot reported[934802]
Debianruby-nokogirisourcebookworm1.10.4+dfsg1-1not yet assignedNot reported[934802]
Ubunturuby-nokogirideb16.041.6.7.2-3ubuntu0.1Not reportedUSN-4175-1Not reported
Ubunturuby-nokogirideb18.041.8.2-1ubuntu0.1Not reportedUSN-4175-1Not reported
Suserubygem-nokogirirpmopenstack cloud 71.6.1-5.3.1Not reportedSUSE-SU-2021:0210-1Not reported
Suserubygem-nokogirirpmopenstack cloud crowbar 81.6.1-5.3.1Not reportedSUSE-SU-2021:0210-1Not reported
Suserubygem-nokogirirpmopenstack cloud crowbar 91.6.1-5.3.1Not reportedSUSE-SU-2021:0210-1Not reported
Ubunturuby-nokogiridebpro1.6.1+ds-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2019-5477Not reported
Ubunturuby-nokogirideb16.041.6.7.2-3ubuntu0.1Not reportedUBUNTU-CVE-2019-5477Not reported
Ubunturuby-nokogirideb18.041.8.2-1ubuntu0.1Not reportedUBUNTU-CVE-2019-5477Not reported
Suserubygem-nokogirirpmlinux enterprise high availability extension 151.8.5-3.6.1Not reportedSUSE-SU-2021:0251-1Not reported
Suserubygem-nokogirirpmlinux enterprise high availability extension 15 sp11.8.5-3.6.1Not reportedSUSE-SU-2021:0251-1Not reported
Suserubygem-nokogirirpmlinux enterprise high availability extension 15 sp21.8.5-3.6.1Not reportedSUSE-SU-2021:0251-1Not reported
Opensuserubygem-nokogirirpmleap 15.21.8.5-lp152.4.3.1Not reportedOPENSUSE-SU-2021:0237-1Not reported

[Debian bug #940905][Debian bug #934802]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [rexical]Fixed
    Details (2)

    • 1.0.7-2 · all · bookworm

      Fixed · Fixed: 1.0.7-1

      dsa · rexical · debian · bookworm; dsa · rexical · debian · 12

    • 1.0.7-2 · all · bookworm

      Fixed · Fixed: 1.0.7-1

      dsa · rexical · debian · bookworm; dsa · rexical · debian · 12

  • [ruby-nokogiri]Fixed

    Source package: [ruby-nokogiri]

    Details (2)

    • 1.13.10+dfsg-2+b1 · amd64 · bookworm

      Fixed · Fixed: 1.10.4+dfsg1-1

      dsa · ruby-nokogiri · debian · bookworm; dsa · ruby-nokogiri · debian · 12

    • 1.13.10+dfsg-2+b1 · arm64 · bookworm

      Fixed · Fixed: 1.10.4+dfsg1-1

      dsa · ruby-nokogiri · debian · bookworm; dsa · ruby-nokogiri · debian · 12

[Debian 13 (Trixie)]

  • [rexical]Fixed
    Details (2)

    • 1.0.7-2 · all · trixie

      Fixed · Fixed: 1.0.7-1

      dsa · rexical · debian · 13

    • 1.0.7-2 · all · trixie

      Fixed · Fixed: 1.0.7-1

      dsa · rexical · debian · 13

  • [ruby-nokogiri]Fixed

    Source package: [ruby-nokogiri]

    Details (2)

    • 1.18.2+dfsg-1+b1 · amd64 · trixie

      Fixed · Fixed: 1.10.4+dfsg1-1

      dsa · ruby-nokogiri · debian · 13

    • 1.18.2+dfsg-1+b1 · arm64 · trixie

      Fixed · Fixed: 1.10.4+dfsg1-1

      dsa · ruby-nokogiri · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]