CVE-2020-8130: Command Injection
Last updated 25 August 2025
Other sources
There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.
— Launchpad
There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/raketo a version that resolves this vulnerability.Fixed in 12.3.3 - Upgrade
Upgrade
redhat/raketo a version that resolves this vulnerability.Fixed in 12.3.3 - Upgrade
Upgrade
debian/raketo a version that resolves this vulnerability.Fixed in 13.0.3-1Fixed in 13.0.6-3Fixed in 13.2.1-1Fixed in 13.4.2-1 - Upgrade
Upgrade
ruby/raketo a version that resolves this vulnerability.Fixed in 12.3.3 - Compensating control
Mitigate the OS command injection by ensuring untrusted filenames supplied to Ruby Rake::FileList do not begin with the pipe character `|`.
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-8130.
What is the affected software?
The affected software is Ruby Rake before version 12.3.3.
What is the severity of CVE-2020-8130?
The severity of CVE-2020-8130 is medium with a score of 6.4.
How does the OS command injection vulnerability in Ruby Rake work?
The OS command injection vulnerability in Ruby Rake occurs when supplying a filename that begins with the pipe character `|` in `Rake::FileList`.
How can I fix the CVE-2020-8130 vulnerability?
To fix the CVE-2020-8130 vulnerability, upgrade Ruby Rake to version 12.3.3 or later.