Critical severity9.8NVD Advisory· Published Jul 21, 2017· Updated May 13, 2026

CVE-2017-7540

Description

rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
safemodeRubyGems	< 1.3.2	1.3.2

Affected products

Safemode Project/Safemode
cpe:2.3:a:safemode_project:safemode:*:*:*:*:*:ruby:*:*
Range: <=1.3.2
Red Hat, Inc./rubygem-safemodev5
Range: 1.3.2 and earlier

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-5vx5-9q73-wgp4ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2017-7540ghsaADVISORY
github.com/rubysec/ruby-advisory-db/blob/master/gems/safemode/CVE-2017-7540.ymlghsaWEB
github.com/svenfuchs/safemode/pull/23nvdIssue TrackingWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000