CVE-2019-5477

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

• CWE-78
• CWE-78

• https://github.com/sparklemotion/nokogiri/issues/1915Patch, Third Party Advisory
• https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdocRelease Notes
• https://hackerone.com/reports/650835Permissions Required
• https://lists.debian.org/debian-lts-announce/2019/09/msg00027.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/10/msg00018.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/10/msg00019.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202006-05Third Party Advisory
• https://usn.ubuntu.com/4175-1/Third Party Advisory
• https://github.com/sparklemotion/nokogiri/issues/1915Patch, Third Party Advisory
• https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdocRelease Notes
• https://hackerone.com/reports/650835Permissions Required
• https://lists.debian.org/debian-lts-announce/2019/09/msg00027.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/10/msg00018.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/10/msg00019.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202006-05Third Party Advisory
• https://usn.ubuntu.com/4175-1/Third Party Advisory

Published

Aug 16, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-5471An input validation and output encoding issue was discovered…5.4
• CVE-2019-5472An authorization issue was discovered in Gitlab versions < 1…7.5
• CVE-2019-5473An authentication issue was discovered in GitLab that allowe…7.2
• CVE-2019-5474An authorization issue was discovered in GitLab EE < 12.1.2,…6.5
• CVE-2019-5475The Nexus Yum Repository Plugin in v2 is vulnerable to Remot…
• CVE-2019-5476An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (ru…9.8
• CVE-2019-5478A weakness was found in Encrypt Only boot mode in Zynq Ultra…5.5
• CVE-2019-5479An unintended require vulnerability in <v0.5.5 larvitbase-ap…7.5
• CVE-2019-5480A path traversal vulnerability in <= v0.9.7 of statichttpser…
• CVE-2019-5481Double-free vulnerability in the FTP-kerberos code in cURL 7…9.8
• CVE-2019-5482Heap buffer overflow in the TFTP protocol handler in cURL 7.…9.8
• CVE-2019-5483Seneca < 3.9.0 contains a vulnerability that could lead to e…5.3