Skip to content
Fencer Vulns
critical 9.8

CVE-2019-5477 json

Nokogiri Command Injection Vulnerability

published 2019-08-16 7 y ago modified 2026-06-17 4 mo ago also GHSA-cr5j-953j-xw5p , EUVD-2019-0629

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
5.9%
EPSS 5.9% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

Patch / fix

  • rubygems nokogiri 1.10.4
  • rubygems rexical 1.0.7
  • rexical Debian 14, Debian 13, Debian 12 1.0.7-1
  • ruby-nokogiri Debian 14, Debian 13, Debian 12 1.10.4+dfsg1-1

debian advisories DEBIAN-CVE-2019-5477

  • ruby-nokogiri Ubuntu 16.04 LTS 1.6.7.2-3ubuntu0.1
  • ruby-nokogiri Ubuntu 18.04 LTS 1.8.2-1ubuntu0.1
  • ruby-nokogiri Ubuntu Pro 14.04 LTS 1.6.1+ds-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2019-5477

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rubygem-nokogiri SLE High Availability Extension 15 SP2, SLE High Availability Extension 15 SP1, SLE High Availability Extension 15 1.8.5-3.6.1
  • rubygem-nokogiri OpenStack Cloud Crowbar 9, OpenStack Cloud Crowbar 8, OpenStack Cloud 7 1.6.1-5.3.1
  • novnc OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.0.0-3.6.3
  • grafana OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 4.6.5-4.6.3
  • mariadb OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 10.2.25-4.14.2
  • galera-3 OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 25.3.25-4.6.3
  • crowbar-ha OpenStack Cloud Crowbar 8 5.0+git.1567673535.607aada-3.26.2
  • crowbar-ui OpenStack Cloud Crowbar 8 1.2.0+git.1568396400.0344a727-3.12.3

suse advisories SUSE-SU-2021:0251-1SUSE-SU-2021:0210-1SUSE-SU-2019:2867-1SUSE-SU-2019:2671-1

  • rubygem-nokogiri openSUSE Tumbleweed 1.18.9-1.4
  • rubygem-nokogiri openSUSE Tumbleweed 1.18.2-1.1
  • rubygem-nokogiri openSUSE Tumbleweed 1.15.5-1.5
  • rubygem-nokogiri openSUSE Tumbleweed 1.13.3-1.1
  • ruby3.2-rubygem-nokogiri openSUSE Tumbleweed 1.13.9-1.7
  • rubygem-nokogiri openSUSE Leap 15.2 1.8.5-lp152.4.3.1

opensuse advisories openSUSE-SU-2026:10356-1openSUSE-SU-2025:14697-1openSUSE-SU-2024:14174-1openSUSE-SU-2024:11912-1openSUSE-SU-2024:13165-1openSUSE-SU-2021:0237-1

  • ruby-nokogiri Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 1.10.4-r0

alpine advisories ALPINE-CVE-2019-5477

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Exploit prediction

5.90% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
rubygems nokogiri
<1.10.4
1.10.4
rubygems rexical
<1.0.7
1.0.7

Affected products

  • n/a Nokogiri (ruby gem)

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.