CVE-2013-0175
Improper Input Validation in multi_xml
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Exploit likelihood
What each source reports
NVD Score used
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
CVE-2013-0175- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
CVE-2013-0175- Updated
- 2026-11-02
EUVDEUVD-2017-0282 No score
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
EUVD-2017-0282- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pchc-949f-53m5 No score
Improper Input Validation in multi_xml
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
GHSA-pchc-949f-53m5- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-pchc-949f-53m5 No score
Improper Input Validation in multi_xml
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
GHSA-pchc-949f-53m5- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11339-1 No score
ruby2.7-rubygem-multi_xml-0.6.0-1.14 on GA media
These are all security issues fixed in the ruby2.7-rubygem-multi_xml-0.6.0-1.14 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11339-1- Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:13164-1 No score
ruby3.2-rubygem-multi_xml-0.6.0-1.23 on GA media
These are all security issues fixed in the ruby3.2-rubygem-multi_xml-0.6.0-1.23 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13164-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14173-1 No score
ruby3.3-rubygem-multi_xml-0.6.0-1.27 on GA media
These are all security issues fixed in the ruby3.3-rubygem-multi_xml-0.6.0-1.27 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14173-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15122-1 No score
ruby3.4-rubygem-multi_xml-0.6.0-1.29 on GA media
These are all security issues fixed in the ruby3.4-rubygem-multi_xml-0.6.0-1.29 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15122-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10355-1 No score
ruby4.0-rubygem-multi_xml-0.6.0-1.31 on GA media
These are all security issues fixed in the ruby4.0-rubygem-multi_xml-0.6.0-1.31 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10355-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
multi_xmlRubyGems |
before 0.5.2 | 0.5.2 |
multi_xmlRubyGems |
before 0.5.2, plus listed versions 0.0.10.1.00.1.10.1.20.1.3 Show 12 moreShow less0.1.40.2.00.2.10.2.20.3.00.4.00.4.10.4.20.4.30.4.40.5.00.5.1 |
0.5.2 |
ruby3.2-rubygem-multi_xmlopenSUSE:Tumbleweed |
before 0.6.0-1.23 | 0.6.0-1.23 |
rubygem-multi_xmlopenSUSE:Tumbleweed |
before 0.6.0-1.27 | 0.6.0-1.27 |
rubygem-multi_xmlopenSUSE:Tumbleweed |
before 0.6.0-1.29 | 0.6.0-1.29 |
rubygem-multi_xmlopenSUSE:Tumbleweed |
before 0.6.0-1.31 | 0.6.0-1.31 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-0175 is a high vulnerability (CVSS 7.5) in Grape Project Grape, published April 25, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.73%, the 89th percentile. Fixed in multi_xml 0.5.2.