CVE-2025-53623 json
Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class
published 2025-07-14 15 mo ago modified 2026-06-17 4 mo ago also GHSA-6qjf-g333-pv38 , EUVD-2025-21387
- cvss
- 8.1
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnerability in the `CsvEnumerator` class. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system where the application is running, potentially leading to unauthorized access, data leakage, or complete system compromise. The issue is fixed in versions `1.11.0` and above. Users can mitigate the risk by avoiding the use of untrusted input in the `CsvEnumerator` class and ensuring that any file paths are properly sanitized and validated before being passed to the class methods. Users should avoid using the `count_of_rows_in_file` method with untrusted CSV filenames.
Patch / fix
- rubygems job-iteration 1.11
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 15 mo ago
Exploit prediction
0.83% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
| CNA | 4.0 | 8.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | job-iteration | <1.11 |
1.11 |
Affected products
- Shopify job-iteration
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/Shopify/job-iteration/pull/595
web
-
github.com
/Shopify/job-iteration/commit/1a7adfdd041105a5e45e774cadc6b973a292ba55
web
-
github.com
/Shopify/job-iteration/security/advisories/GHSA-6qjf-g333-pv38
web
-
github.com
/Shopify/job-iteration/releases/tag/v1.11.0
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-53623
advisory
-
github.com
/Shopify/job-iteration
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/job-iteration/CVE-2025-53623.yml
web
Sources
- CVE List CVE-2025-53623
- GitHub Advisory GHSA-6qjf-g333-pv38
- NVD CVE-2025-53623
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.