CVE-2025-54314

State: Published
Severity: 2.8 Low
Published: Jul 20, 2025
Updated: Aug 10, 2025
Reserved: Jul 20, 2025

Description

Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."

Scores

CVSS	Score	Vector	Source
3.1	2.8 Low	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N	mitre

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Thorrubyonrails	before 1.4.0Affected

References

https://github.com/rails/thor/commit/536b79036a0efb765c1899233412e7b1ca94abfa
https://hackerone.com/reports/3260153
https://github.com/rails/thor/pull/897
https://github.com/rails/thor/releases/tag/v1.4.0
https://github.com/github/advisory-database/pull/5912#issuecomment-3169255309

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.