paranoid2 gem Code backdoor

published 2019-07-14 7 y ago modified 2026-06-17 4 mo ago also GHSA-4g4c-8gqh-m4vm , EUVD-2019-0575

cvss: 9.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 4.3%; EPSS 4.3% chance of exploitation in 30 days, percentile 91%
public exploits: 0; none known

The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.

Exploit prediction

4.35% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/rubygems/rubygems.org/issues/2051 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
rubygems	paranoid2	1 listed version	no fix listed

Classification

Weakness

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

References

github.com /rubygems/rubygems.org/issues/2051
web, exploit, issue-tracking, third-party-advisory
rubygems.org /gems/paranoid2/versions
web, vendor-advisory
securityfocus.com /bid/109281
vdb-entry, web, third-party-advisory
snyk.io /vuln/SNYK-RUBY-PARANOID2-451600
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2019-13589
advisory
github.com /anjlab/paranoid2
package
github.com /rubysec/ruby-advisory-db/blob/master/gems/paranoid2/CVE-2019-13589.yml
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary