CVE-2019-16255: Code Injection
Last updated 11 July 2025
Other sources
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-ruby25-rubyto a version that resolves this vulnerability.Fixed in 0:2.5.9-9.el7 - Upgrade
Upgrade
redhat/rh-ruby26-rubyto a version that resolves this vulnerability.Fixed in 0:2.6.7-119.el7 - Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 2.4.8 - Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 2.5.7 - Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 2.6.5 - Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 2.7.0 - Upgrade
Upgrade
debian/jrubyto a version that resolves this vulnerability.Fixed in 9.3.9.0+ds-8Fixed in 9.4.8.0+ds-3
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-16255?
CVE-2019-16255 is a vulnerability in Ruby versions 2.4.7 through 2.6.4 that allows code injection if untrusted data is passed as the first argument to Shell#[] or Shell#test.
How severe is CVE-2019-16255?
CVE-2019-16255 has a severity score of 8.1 (high).
What is the affected software of CVE-2019-16255?
The affected software of CVE-2019-16255 includes Ruby versions 2.4.7 to 2.6.4.
How can an attacker exploit CVE-2019-16255?
An attacker can exploit CVE-2019-16255 by passing untrusted data as the first argument to Shell#[] or Shell#test.
Are there any remediation steps for CVE-2019-16255?
Yes, the recommended remediation steps for CVE-2019-16255 are to upgrade Ruby to version 2.4.8, 2.5.7, or 2.6.5.