VYPR
← All advisories
High severityNVD Advisory· Published Jul 29, 2021· Updated Oct 15, 2024

CVE-2021-31799

CVE-2021-31799

Description

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

RDoc 3.11 to 6.3.0 uses Kernel#open to process filenames; a filename starting with | and ending with tags can execute arbitrary commands when rdoc is run.

Vulnerability

In RDoc versions 3.11 through 6.3.0, the Kernel#open method is used to open local files [4]. If a filename begins with | and ends with tags, the command following the pipe character is executed [1][4]. This affects RDoc as distributed with Ruby up to 3.0.1 [1].

Exploitation

An attacker can create a Ruby project containing a file named in the format |command|tags. When a user runs rdoc on this project, RDoc processes the file and the injected command is executed [4]. No authentication or network access is required; only the ability to provide a malicious filename in the project directory.

Impact

Successful exploitation allows arbitrary command execution with the user's privileges [4]. This could lead to code execution, data theft, or further compromise of the system [1].

Mitigation

The vulnerability is fixed in RDoc 6.3.1 and in Ruby versions 3.0.2, 2.7.4, and 2.6.8 [4]. Users should update RDoc to the latest version or upgrade Ruby accordingly. No workarounds are available [4].

References
  1. NVD - CVE-2021-31799
  2. CVE-2021-31799: A command injection vulnerability in RDoc | Ruby

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rdocRubyGems
>= 3.11, < 6.1.2.16.1.2.1
rdocRubyGems
>= 6.2.0, < 6.2.1.16.2.1.1
rdocRubyGems
>= 6.3.0, < 6.3.16.3.1

Affected products

83

Patches

1
a7f5d6ab8863

Use File.open to fix the OS Command Injection vulnerability in CVE-2021-31799

https://github.com/ruby/rdocaycabtaMay 2, 2021via ghsa
commit
2 files changed · +13 −1
  • lib/rdoc/rdoc.rb+1 −1 modified
    @@ -443,7 +443,7 @@ def remove_unparseable files
     files.reject do |file, *|
       file =~ /\.(?:class|eps|erb|scpt\.txt|svg|ttf|yml)$/i or
         (file =~ /tags$/i and
-         open(file, 'rb') { |io|
+         File.open(file, 'rb') { |io|
            io.read(100) =~ /\A(\f\n[^,]+,\d+$|!_TAG_)/
          })
     end
  • test/rdoc/test_rdoc_rdoc.rb+12 −0 modified
    @@ -456,6 +456,18 @@ def test_remove_unparseable_tags_vim
     end
   end
 
+  def test_remove_unparseable_CVE_2021_31799
+    temp_dir do
+      file_list = ['| touch evil.txt && echo tags']
+      file_list.each do |f|
+        FileUtils.touch f
+      end
+
+      assert_equal file_list, @rdoc.remove_unparseable(file_list)
+      assert_equal file_list, Dir.children('.')
+    end
+  end
+
   def test_setup_output_dir
     Dir.mktmpdir {|d|
       path = File.join d, 'testdir'

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

12

News mentions

0

No linked articles in our index yet.