CVE-2019-15224

CRITICAL

rest-client 1.6.10-1.6.13 - Remote Code Execution via Malicious Gem

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-15224. PoCs published by chef-cft.

AI-analyzed exploit summary This repository provides an InSpec-based scanner to detect the presence of malicious versions of the `rest-client` gem (CVE-2019-15224) and other related malicious gems on a filesystem. It uses system commands to search for directories matching specific patterns.

Description

The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.

Exploits (1)

nomisec SCANNER 1 stars
by chef-cft · poc
https://github.com/chef-cft/inspec_cve_2019_15224

This repository provides an InSpec-based scanner to detect the presence of malicious versions of the `rest-client` gem (CVE-2019-15224) and other related malicious gems on a filesystem. It uses system commands to search for directories matching specific patterns.

Classification
Scanner 95%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: rest-client gem versions 1.6.10-1.6.13 and related malicious gems
No auth needed
Prerequisites: Access to the target filesystem
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/rest-client/rest-client/issues/713

Scores

CVSS v3 9.8
EPSS 0.0216
EPSS Percentile 84.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (11)
rest-client_project/rest-client 1.6.10 - 1.6.13
rubygems/awesome-bot 0RubyGems
rubygems/bitcoin_vanity 0RubyGems
rubygems/blockchain_wallet 0RubyGems
rubygems/capistrano-colors 0RubyGems
rubygems/coin_base 0RubyGems
rubygems/coming-soon 0RubyGems
rubygems/cron_parser 1.0.13RubyGems
rubygems/doge-coin 0RubyGems
rubygems/omniauth_amazon 0RubyGems
... and 1 more
Published Aug 19, 2019
Tracked Since Feb 18, 2026