CVE-2025-54314

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-54314

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54314.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-54314

Downstream

UBUNTU-CVE-2025-54314

openSUSE-SU-2025:15382-1

Related

Withdrawn

2025-08-10T00:19:19Z

Published

2025-07-20T03:15:22Z

Modified

2025-08-10T03:15:51.993041Z

Summary

[none]

Details

Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."

References

Affected packages

Debian:11 / ruby-thor

Package

Name: ruby-thor
Purl: pkg:deb/debian/ruby-thor?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.1-1

1.2.1-1

1.2.1-2

1.2.2-1

1.3.0-1

1.3.1-1

1.3.2-1

1.3.2-2

1.3.2-2.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / ruby-thor

Package

Name: ruby-thor
Purl: pkg:deb/debian/ruby-thor?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.2.1-2

1.2.2-1

1.3.0-1

1.3.1-1

1.3.2-1

1.3.2-2

1.3.2-2.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / ruby-thor

Package

Name: ruby-thor
Purl: pkg:deb/debian/ruby-thor?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.2-2.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14 / ruby-thor

Package

Name: ruby-thor
Purl: pkg:deb/debian/ruby-thor?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.2-2.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/rails/thor

Affected ranges

Type: GIT
Repo: https://github.com/rails/thor
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

518ae0f49bb1c3dc2226607c07da74b591759ed0

Fixed

536b79036a0efb765c1899233412e7b1ca94abfa

Affected versions

0.*

0.9.1

0.9.2

0.9.4

0.9.5

v0.*

v0.12.2

v0.12.3

v0.13.0

v0.13.1

v0.13.2

v0.13.3

v0.13.4

v0.13.5

v0.13.6

v0.13.7

v0.13.8

v0.14.0

v0.14.2

v0.14.3

v0.14.4

v0.14.5

v0.14.6

v0.15.0

v0.15.0.rc2

v0.15.1

v0.15.2

v0.15.4

v0.16.0

v0.17.0

v0.18.0

v0.18.1

v0.19.0

v0.19.1

v0.19.2

v0.19.3

v0.19.4

v0.20.0

v0.20.1

v0.20.2

v0.20.3

v1.*

v1.0.0

v1.0.1

v1.1.0

v1.2.0

v1.2.1

v1.2.2

v1.3.0

v1.3.1

v1.3.2