Withdrawn Advisory: Thor can construct an unsafe shell command from library input.

🗓️ 20 Jul 2025 03:30:19Reported by GitHub Advisory DatabaseType

Thor versions before 1.4.0 can create unsafe shell commands from library input

Reporter	Title	Published	Views	Family All 39
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex	8 Oct 202521:36	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Orchestrator	30 Oct 202517:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affects IBM License Metric Tool v9.	22 Sep 202508:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Shares	5 Dec 202514:45	–	ibm
Tenable Nessus	Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2025-1124)	4 Aug 202500:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2025-54314	5 Aug 202500:00	–	nessus
Amazon	Low: ruby3.2	8 Aug 202500:00	–	amazon
CBLMariner	CVE-2025-54314 affecting package rubygem-thor for versions less than 1.2.1-3	3 Oct 202515:08	–	cbl_mariner
Chainguard	CVE-2025-54314 vulnerabilities	23 Jul 202501:17	–	cgr
Circl	CVE-2025-54314	20 Jul 202506:51	–	circl

Vulners

Node

heimdalsecurity thorRange<1.4.0rubygems

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-54314
github	www.github.com/rails/thor/pull/897
github	www.github.com/rails/thor/commit/536b79036a0efb765c1899233412e7b1ca94abfa
hackerone	www.hackerone.com/reports/3260153
github	www.github.com/rails/thor/releases/tag/v1.4.0
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/thor/CVE-2025-54314.yml
github	www.github.com/github/advisory-database/pull/5912
github	www.github.com/advisories/GHSA-mqcp-p2hv-vw6x

13 Aug 2025 18:55Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.12.8

EPSS0.00088

SSVC