EUVD-2019-0629

🗓️ 07 Oct 2025 00:30:54Reported by EUVDType

Command injection vulnerability in Nokogiri v1.10.3 and earlier via unsafe user input in load_file method

Reporter	Title	Published	Views	Family All 105
FreeBSD	Nokogiri -- injection vulnerability	11 Aug 201900:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Ruby on Rails affect IBM License Metric Tool v9.	17 Dec 201916:14	–	ibm
AlpineLinux	CVE-2019-5477	16 Aug 201900:00	–	alpinelinux
AstraLinux	Astra Linux - уязвимость в ruby-nokogiri	3 May 202623:59	–	astralinux
Circl	CVE-2019-5477	13 Oct 202509:10	–	circl
CVE	CVE-2019-5477	16 Aug 201900:00	–	cve
Cvelist	CVE-2019-5477	16 Aug 201900:00	–	cvelist
Debian	[SECURITY] [DLA 1933-1] ruby-nokogiri security update	26 Sep 201901:54	–	debian
Debian	[SECURITY] [DLA 3149-1] ruby-nokogiri security update	12 Oct 202214:46	–	debian
Debian	[SECURITY] [DLA 3150-1] rexical security update	12 Oct 202214:46	–	debian

[
  {
    "enisaIdVendor": [
      {
        "id": "fbeff7a8-ee93-3558-bb89-5247bddbd2b2",
        "vendor": {
          "name": "n/a"
        }
      }
    ]
  }
]

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-5477
github	www.github.com/sparklemotion/nokogiri/issues/1915
github	www.github.com/sparklemotion/nokogiri/commit/5d30128343573a9428c86efc758ba2c66e9f12dc
github	www.github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926
hackerone	www.hackerone.com/reports/650835
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5477.yml
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/rexical/CVE-2019-5477.yml
github	www.github.com/sparklemotion/nokogiri
github	www.github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc
lists	www.lists.debian.org/debian-lts-announce/2019/09/msg00027.html

07 Oct 2025 00:30Current

8.5High risk

Vulners AI Score8.5

CVSS 3.19.8

CVSS 27.5

EPSS0.09316