High severity7.8NVD Advisory· Published Jul 12, 2019· Updated Jun 17, 2026
CVE-2019-13574
CVE-2019-13574
Description
In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mini_magickRubyGems | < 4.9.4 | 4.9.4 |
Affected products
5- MiniMagick/MiniMagickdescription
Patches
Vulnerability mechanics
References
11- github.com/minimagick/minimagick/commit/4cd5081e58810d3394d27a67219e8e4e0445d851nvdPatchThird Party AdvisoryWEB
- github.com/minimagick/minimagick/compare/d484786...293f9bbnvdPatchThird Party AdvisoryWEB
- benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/nvdExploitThird Party Advisory
- github.com/advisories/GHSA-r7j3-vvh2-xrpjghsaADVISORY
- github.com/minimagick/minimagick/releases/tag/v4.9.4nvdRelease NotesThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2019-13574ghsaADVISORY
- seclists.org/bugtraq/2019/Jul/20nvdMailing ListThird Party AdvisoryWEB
- www.debian.org/security/2019/dsa-4481nvdThird Party AdvisoryWEB
- benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4ghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/mini_magick/CVE-2019-13574.ymlghsaWEB
- lists.debian.org/debian-lts-announce/2019/10/msg00007.htmlnvdWEB
News mentions
0No linked articles in our index yet.