$ cve CVE-2019-5477 JSON

CVE-2019-5477

9.8

CRITICAL · CVSS 3.1 · EPSS 5.9% (pctl 93)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	5.9% — more likely to be exploited than 93% of all CVEs
Weakness	CWE-78
On CISA KEV	no
Public exploit	none known
Published	2019-08-16
Last modified	2026-06-17

Affected (3)

Vendor	Product
canonical	ubuntu linux
debian	debian linux
nokogiri	nokogiri

References

→ the Explorer · watch your stack · NVD