cve.bz

CVE-2013-0285

no score yetEPSS 2.3%

The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
EPSS
2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWE
CWE-20
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-4936-rj25-6wm6RubyGemsnori>=2.0.0 <2.0.22.0.2
GHSA-4936-rj25-6wm6RubyGemsnori>=1.1.0 <1.1.41.1.4
GHSA-4936-rj25-6wm6RubyGemsnori>=1.0.0 <1.0.31.0.3

References

Check your stackJSON