VYPR
← All advisories
High severityNVD Advisory· Published Jun 17, 2019· Updated Aug 4, 2024

CVE-2019-8321

CVE-2019-8321

Description

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

RubyGems verbose output lacks escaping, allowing escape sequence injection via crafted gem names or messages.

The vulnerability CVE-2019-8321 affects RubyGems versions 2.6 through 3.0.2. The issue is in the Gem::UserInteraction#verbose method, which calls say without properly escaping output. This allows escape sequence injection into terminal output [1][2].

An attacker can craft a gem name or other output that includes ANSI escape sequences. When a user runs commands such as gem install with verbose mode, the sequences are interpreted by the terminal [2].

The impact is limited to terminal output manipulation. Attackers could hide malicious actions, display fake errors, or cause denial of service through scrolling attacks. However, it does not enable arbitrary code execution [2].

The vulnerability is fixed in RubyGems versions 3.0.3 and 2.7.8. Users unable to upgrade can apply a patch for version 2.6 [2].

References
  1. NVD - CVE-2019-8321
  2. March 2019 Security Advisories

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rubygems-updateRubyGems
>= 2.6.0, < 2.7.92.7.9
rubygems-updateRubyGems
>= 3.0.0, < 3.0.23.0.2

Affected products

29

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.