Command Injection Affecting mechanize package, versions >=2.0.0, <2.7.7
Threat Intelligence
EPSS
0.3% (71st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-MECHANIZE-1069888
- published 3 Feb 2021
- disclosed 1 Feb 2021
- credit YOSHIDA Katsuhiko
Introduced: 1 Feb 2021
CVE-2021-21289 Open this link in a new tabHow to fix?
Upgrade mechanize to version 2.7.7 or higher.
Overview
Affected versions of this package are vulnerable to Command Injection. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body.
References
CVSS Scores
version 3.1