CVE-2019-10780

CRITICAL

bibtex-ruby < 5.1.0 - OS Command Injection via BibTeX.open

Title source: llm
STIX 2.1

Description

BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.

References (1)

Core 1
Core References
Exploit, Patch, Third Party Advisory x_refsource_misc
https://snyk.io/vuln/SNYK-RUBY-BIBTEXRUBY-542602

Scores

CVSS v3 9.8
EPSS 0.0284
EPSS Percentile 86.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (2)
bibtex-ruby_project/bibtex-ruby < 5.1.0
rubygems/bibtex-ruby 0 - 5.1.0RubyGems
Published Jan 22, 2020
Tracked Since Feb 18, 2026