CVE-2019-5477: Command Injection

August 16, 2019 (updated September 26, 2019)

A command injection vulnerability in Nokogiri allows commands to be executed in a subprocess via Ruby’s Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being called with unsafe user input as the filename.

References

github.com/sparklemotion/nokogiri/issues/1915
nvd.nist.gov/vuln/detail/CVE-2019-5477

Code Behaviors & Features

Detect and mitigate CVE-2019-5477 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →