CVE-2013-1802
extlib does not properly restrict casts of string values
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Exploit likelihood
What each source reports
NVD Score used
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
CVE-2013-1802- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
CVE-2013-1802- Updated
- 2026-11-02
EUVDEUVD-2017-0204 No score
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
EUVD-2017-0204- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9h36-4jf2-hx53 No score
extlib does not properly restrict casts of string values
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
GHSA-9h36-4jf2-hx53- Weakness
- CWE-704
- Updated
- 2026-11-02
OSV No score
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
CVE-2013-1802- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1802 No score
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
DEBIAN-CVE-2013-1802- Updated
- 2026-11-02
OSVGHSA-9h36-4jf2-hx53 No score
extlib does not properly restrict casts of string values
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
GHSA-9h36-4jf2-hx53- Weakness
- CWE-704
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-1802 No score
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
UBUNTU-CVE-2013-1802- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
extlibRubyGems |
before 0.9.16 | 0.9.16 |
ruby-extlibDebian:12 |
before 0.9.15-3 | 0.9.15-3 |
ruby-extlibDebian:13 |
before 0.9.15-3 | 0.9.15-3 |
ruby-extlibDebian:14 |
before 0.9.15-3 | 0.9.15-3 |
libextlib-rubyDebian:6.0 |
before 0.9.13-2+deb6u1, plus listed versions 0.9.13-2 |
0.9.13-2+deb6u1 |
extlibRubyGems |
before 0.9.16, plus listed versions 0.9.100.9.110.9.120.9.130.9.14 Show 9 moreShow less0.9.150.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.9 |
0.9.16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1802 is a high vulnerability (CVSS 7.5) in Dan Kubb Extlib, published April 9, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.42%, the 88th percentile. Fixed in extlib 0.9.16.
References
github.com/datamapper/extlib/compare/b4f98174ec35ac96f76a08d5624fad05d22879b5...4540e7102b803624cc2eade4bb8aaaa934fc31c5
lists.opensuse.org/opensuse-security-announce/2013-04/msg00002.html
support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately
bugzilla.redhat.com/show_bug.cgi?id=917233
nvd.nist.gov/vuln/detail/CVE-2013-1802
web.archive.org/web/20130203232028/https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately