{"action":"Upgrade carrierwave to 1.3.2 or later.","affected":[{"fixed":"1.3.2","introduced":"0"},{"fixed":"2.1.1","introduced":"2.0.0"}],"component":"carrierwave","cve_ids":["CVE-2021-21305"],"ecosystem":"RubyGems","epss":0.13208,"exploited":false,"fixed_versions":["1.3.2","2.1.1"],"ghsa_id":"GHSA-cf3w-g86h-35x4","id":"tcs_01M5KEJPR1VSKABMWE0HYMZJT9","modified_at":"2026-07-08T06:28:16.049382966Z","published_at":"2021-02-08T19:16:39Z","references":["https://osv.dev/vulnerability/GHSA-cf3w-g86h-35x4","https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4","https://nvd.nist.gov/vuln/detail/CVE-2021-21305","https://github.com/carrierwaveuploader/carrierwave/commit/387116f5c72efa42bc3938d946b4c8d2f22181b7","https://github.com/carrierwaveuploader/carrierwave","https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08","https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2021-21305.yml","https://rubygems.org/gems/carrierwave"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-cf3w-g86h-35x4","url":"https://osv.dev/vulnerability/GHSA-cf3w-g86h-35x4"}],"summary":"Code Injection vulnerability in CarrierWave::RMagick"}