CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2021-21305
High (8.8) in carrierwave project carrierwave. EPSS 13% chance of exploitation in the next 30 days. Fixed in carrierwave 1.3.2, 2.1.1.
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.
Severity
- EPSS
- 13% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-94, CWE-74
- Published
- Modified
- Record from
- the NVD, synced
Affected
- carrierwave_project:carrierwave
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cf3w-g86h-35x4 | RubyGems | carrierwave | <1.3.2 | 1.3.2 |
| GHSA-cf3w-g86h-35x4 | RubyGems | carrierwave | >=2.0.0 <2.1.1 | 2.1.1 |
References
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08
- https://github.com/carrierwaveuploader/carrierwave/commit/387116f5c72efa42bc3938d946b4c8d2f22181b7
- https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4
- https://rubygems.org/gems/carrierwave