RubyGems/spree CVE-2011-10026: critical 9.8, EPSS 3.76%

Spree Commerce is vulnerable to RCE through Search API

Action: Upgrade spree to 0.50.0 or later.

bundle update spree

Affected

Fixed versions

Sources

• osv: GHSA-x485-rhg3-cqr4
• nvd: CVE-2011-10026
• https://github.com/spree/spree/commit/0a9a360c590829d8a377ceae0cf997bbbbcc2df4
• https://github.com/spree/spree/commit/3b559e7219f3681184be409ad00cd34a34a37978
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rd_searchlogic/CVE-2011-10026.yml
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2011-10026.yml
• https://github.com/spree
• https://github.com/spree/spree
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/spree_searchlogic_exec.rb
• https://web.archive.org/web/20111120023342/http://spreecommerce.com/blog/2011/04/19/security-fixes
• https://www.exploit-db.com/exploits/17199
• https://www.vulncheck.com/advisories/spreecommerce-api-rce

CVE-2011-10026 · published 2025-08-20T18:30:21Z · modified 2025-12-01T16:19:27.662393Z · JSON