VYPR
← All advisories
High severityNVD Advisory· Published Jun 17, 2019· Updated Aug 4, 2024

CVE-2019-8325

CVE-2019-8325

Description

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

RubyGems 2.6 through 3.0.2 allows escape sequence injection via Gem::CommandManager#run calling alert_error without escaping.

Vulnerability

An issue in RubyGems versions 2.6 and later through 3.0.2 allows escape sequence injection. The Gem::CommandManager#run method calls alert_error without escaping user-controlled input, enabling an attacker to inject terminal escape sequences into error messages [1][2].

Exploitation

An attacker can trigger an error in a gem command (e.g., by providing a crafted gem or API response) that causes alert_error to be called with unescaped input. No authentication is required; the user only needs to run a vulnerable RubyGems command that encounters an error [2].

Impact

Successful injection of escape sequences can lead to arbitrary command execution if the terminal interprets the sequences (e.g., ANSI escape codes). This may result in information disclosure, privilege escalation, or other malicious actions depending on the terminal environment [2][3].

Mitigation

Upgrade to RubyGems 3.0.3 or 2.7.8, released on March 5, 2019 [2]. If upgrading is not possible, apply the provided patch for RubyGems 2.6 [2]. No other workarounds are available.

References
  1. NVD - CVE-2019-8325
  2. March 2019 Security Advisories
  3. ruby-advisory-db/gems/rubygems-update/CVE-2019-8325.yml at master · rubysec/ruby-advisory-db

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rubygems-updateRubyGems
>= 2.6.0, < 2.7.92.7.9
rubygems-updateRubyGems
>= 3.0.0, < 3.0.23.0.2

Affected products

29

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.