VYPR
← All advisories
Low severity2.8OSV Advisory· Published Jul 20, 2025· Updated Apr 15, 2026

CVE-2025-54314

CVE-2025-54314

Description

Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
thorRubyGems
< 1.4.01.4.0

Affected products

1

Patches

2
536b79036a0e

Merge pull request #897 from odaysec/patch-1

https://github.com/rails/thorRafael Mendonça FrançaJul 18, 2025via ghsa
commit
3 files changed · +4 −4
  • lib/thor/shell/basic.rb+1 −1 modified
    @@ -372,7 +372,7 @@ def merge(destination, content) #:nodoc:
         Tempfile.open([File.basename(destination), File.extname(destination)], File.dirname(destination)) do |temp|
           temp.write content
           temp.rewind
-          system %(#{merge_tool} "#{temp.path}" "#{destination}")
+          system(merge_tool, temp.path, destination)
         end
       end
  • spec/actions/create_file_spec.rb+1 −1 modified
    @@ -142,7 +142,7 @@ def silence!
           create_file("doc/config.rb")
           allow(@base.shell).to receive(:merge_tool).and_return("meld")
           expect(Thor::LineEditor).to receive(:readline).and_return("m")
-          expect(@base.shell).to receive(:system).with(/meld/)
+          expect(@base.shell).to receive(:system).with("meld", /doc\/config\.rb/, /doc\/config\.rb/)
           invoke!
         end
       end
  • spec/shell/basic_spec.rb+2 −2 modified
    @@ -553,14 +553,14 @@ def  #456  Lanç...
       it "invokes the merge tool" do
         allow(shell).to receive(:merge_tool).and_return("meld")
         expect(Thor::LineEditor).to receive(:readline).and_return("m")
-        expect(shell).to receive(:system).with(/meld/)
+        expect(shell).to receive(:system).with("meld", /foo/, "foo")
         capture(:stdout) { shell.file_collision("foo") {} }
       end
 
       it "invokes the merge tool that specified at ENV['THOR_MERGE']" do
         allow(ENV).to receive(:[]).with("THOR_MERGE").and_return("meld")
         expect(Thor::LineEditor).to receive(:readline).and_return("m")
-        expect(shell).to receive(:system).with(/meld/)
+        expect(shell).to receive(:system).with("meld", /foo/, "foo")
         capture(:stdout) { shell.file_collision("foo") {} }
       end
518ae0f49bb1
https://github.com/rails/thorvia osv

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.