{"action":"Upgrade nokogiri to 1.10.4 or later.","affected":[{"fixed":"1.10.4","introduced":"0"}],"component":"nokogiri","cve_ids":["CVE-2019-5477"],"ecosystem":"RubyGems","epss":0.05899,"exploited":false,"fixed_versions":["1.10.4"],"ghsa_id":"GHSA-cr5j-953j-xw5p","id":"tcs_01M5KEJVKRAB43G6VYJSCQKDGS","modified_at":"2024-02-18T05:31:26.336802Z","published_at":"2019-08-19T19:27:23Z","references":["https://osv.dev/vulnerability/GHSA-cr5j-953j-xw5p","https://nvd.nist.gov/vuln/detail/CVE-2019-5477","https://github.com/sparklemotion/nokogiri/issues/1915","https://github.com/sparklemotion/nokogiri/commit/5d30128343573a9428c86efc758ba2c66e9f12dc","https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926","https://hackerone.com/reports/650835","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5477.yml","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexical/CVE-2019-5477.yml","https://github.com/sparklemotion/nokogiri","https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc","https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html","https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html","https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html","https://security.gentoo.org/glsa/202006-05","https://usn.ubuntu.com/4175-1"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-cr5j-953j-xw5p","url":"https://osv.dev/vulnerability/GHSA-cr5j-953j-xw5p"}],"summary":"Nokogiri Command Injection Vulnerability"}