CVE-2019-16255: Code Injection
Last updated 11 July 2025
Other sources
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-16255?
CVE-2019-16255 is a vulnerability in Ruby versions 2.4.7 through 2.6.4 that allows code injection if untrusted data is passed as the first argument to Shell#[] or Shell#test.
How severe is CVE-2019-16255?
CVE-2019-16255 has a severity score of 8.1 (high).
What is the affected software of CVE-2019-16255?
The affected software of CVE-2019-16255 includes Ruby versions 2.4.7 to 2.6.4.
How can an attacker exploit CVE-2019-16255?
An attacker can exploit CVE-2019-16255 by passing untrusted data as the first argument to Shell#[] or Shell#test.
Are there any remediation steps for CVE-2019-16255?
Yes, the recommended remediation steps for CVE-2019-16255 are to upgrade Ruby to version 2.4.8, 2.5.7, or 2.6.5.