CVE-2019-15224

rest-client Gem Contains Malicious Code

9.8 CriticalPublic exploitFix available

CVE-2019-15224 is a critical vulnerability (CVSS 9.8) in Rest-client Project Rest-client, published August 19, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.55%, the 89th percentile. Fixed in rest-client 1.7.0.

The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.55%Up 2.5 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.

Record: CVE-2019-15224
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-94
Updated: 2026-11-02

CVE List No score

The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.

Record: CVE-2019-15224
Updated: 2026-11-02

EUVDEUVD-2019-0614 No score

The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.

Record: EUVD-2019-0614
Updated: 2026-11-03

GitHub AdvisoriesGHSA-333g-rpr4-7hxq 9.8

rest-client Gem Contains Malicious Code

The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x. Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory. These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.

Record: GHSA-333g-rpr4-7hxq
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSVGHSA-333g-rpr4-7hxq 9.8

rest-client Gem Contains Malicious Code

Record: GHSA-333g-rpr4-7hxq
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

Affected products

rest-client project rest-client

Affected packages

Affected packages
Package	Affected	Fixed
`rest-client` RubyGems	1.6.10 to 1.6.13	1.7.0
`cron_parser` RubyGems	1.0.13 to 1.0.14	None known
`cron_parser` RubyGems	0.1.4 to 0.1.4	None known
`coin_base` RubyGems	All versions	None known
`blockchain_wallet` RubyGems	All versions	None known
`awesome-bot` RubyGems	All versions	None known
`doge-coin` RubyGems	All versions	None known
`capistrano-colors` RubyGems	All versions	None known
`bitcoin_vanity` RubyGems	All versions	None known
`coming-soon` RubyGems	All versions	None known
`omniauth_amazon` RubyGems	All versions	None known
`rest-client` RubyGems	1.6.10 up to 1.7.0, plus listed versions 1.6.141.7.0.rc1	1.7.0
`cron_parser` RubyGems	Listed versions 0.1.4	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	chef-cft/inspec_cve_2019_15224	2019-08-23

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 6 moreShow less