Command Injection Affecting mechanize package, versions >=2.0.0, <2.7.7
Snyk CVSS
Attack Complexity
Low
User Interaction
Required
Scope
Changed
Integrity
High
Threat Intelligence
EPSS
0.3% (70th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-MECHANIZE-1069888
- published 3 Feb 2021
- disclosed 1 Feb 2021
- credit YOSHIDA Katsuhiko
Introduced: 1 Feb 2021
CVE-2021-21289 Open this link in a new tabHow to fix?
Upgrade mechanize
to version 2.7.7 or higher.
Overview
Affected versions of this package are vulnerable to Command Injection. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open
method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load
, Mechanize::CookieJar#save_as
, Mechanize#download
, Mechanize::Download#save
, Mechanize::File#save
, and Mechanize::FileResponse#read_body
.