CVE-2013-1756
Dragonfly Code Injection vulnerability
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
Exploit likelihood
What each source reports
NVD Score used
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
- Record
CVE-2013-1756- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
- Record
CVE-2013-1756- Updated
- 2026-11-02
EUVDEUVD-2017-0276 No score
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
- Record
EUVD-2017-0276- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p463-639r-q9g9 No score
Dragonfly Code Injection vulnerability
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
- Record
GHSA-p463-639r-q9g9- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-p463-639r-q9g9 No score
Dragonfly Code Injection vulnerability
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
- Record
GHSA-p463-639r-q9g9- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dragonflyRubyGems |
0.7 up to 0.8.6 | 0.8.6 |
dragonflyRubyGems |
0.9 up to 0.9.13 | 0.9.13 |
dragonflyRubyGems |
0.7 up to 0.8.6, plus listed versions 0.7.00.7.10.7.20.7.30.7.4 Show 8 moreShow less0.7.50.7.60.7.70.8.00.8.10.8.20.8.40.8.5 |
0.8.6 |
dragonflyRubyGems |
0.9 up to 0.9.13, plus listed versions 0.9.00.9.10.9.100.9.110.9.12 Show 6 moreShow less0.9.20.9.30.9.40.9.50.9.80.9.9 |
0.9.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1756 is a high vulnerability (CVSS 7.5) in Mark Evans Dragonfly Gem, published June 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.71%, the 89th percentile. Fixed in dragonfly 0.8.6.
References
exchange.xforce.ibmcloud.com/vulnerabilities/82476
securityfocus.com/bid/58225
github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277
groups.google.com/forum?fromgroups=
secunia.com/advisories/52380
nvd.nist.gov/vuln/detail/CVE-2013-1756
web.archive.org/web/20200229103538/http://www.securityfocus.com/bid/58225