{"cve":"CVE-2013-0285","nvd":{"published":"2013-04-09T20:55:01.677","modified":"2026-06-16T23:49:07.343","status":"Modified","description":"The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-20"],"references":["http://seclists.org/oss-sec/2013/q1/304","https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately","http://seclists.org/oss-sec/2013/q1/304","https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately"],"products":["nori_gem_project:nori_gem"],"source":"nvd","synced_at":"2026-10-19T20:27:27.940201468+00:00"},"epss":{"cve":"CVE-2013-0285","score":0.02312,"percentile":0.83396,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4936-rj25-6wm6","url":"https://osv.dev/vulnerability/GHSA-4936-rj25-6wm6","summary":"nori contains Improper Input Validation","modified":"2024-11-29T05:28:02.729764Z","packages":[{"ecosystem":"RubyGems","name":"nori","purl":"pkg:gem/nori","ranges":[">=2.0.0 <2.0.2"],"fixed":["2.0.2"]},{"ecosystem":"RubyGems","name":"nori","purl":"pkg:gem/nori","ranges":[">=1.1.0 <1.1.4"],"fixed":["1.1.4"]},{"ecosystem":"RubyGems","name":"nori","purl":"pkg:gem/nori","ranges":[">=1.0.0 <1.0.3"],"fixed":["1.0.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}