Every CVE Search/ Get API key

CVE-2020-8130

OS Command Injection in Rake

6.4 MediumFix available

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.36%Down 0.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.4

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.

Record
CVE-2020-8130
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-78
Updated
2026-11-02
CVE List No score

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.

Record
CVE-2020-8130
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2020-0305 No score

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.

Record
EUVD-2020-0305
Updated
2026-11-03
GitHub AdvisoriesGHSA-jppv-gw3r-w3q8 6.4

OS Command Injection in Rake

There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.

Record
GHSA-jppv-gw3r-w3q8
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVBELL-CVE-2020-8130 6.4

CVE-2020-8130 does not affect BellSoft software

Record
BELL-CVE-2020-8130
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 6.4

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.

Record
CVE-2020-8130
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2020-8130 6.4

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.

Record
DEBIAN-CVE-2020-8130
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-jppv-gw3r-w3q8 6.4

OS Command Injection in Rake

There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.

Record
GHSA-jppv-gw3r-w3q8
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVRHSA-2021:4702 9.8

Red Hat Security Advisory: Satellite 6.10 Release

Record
RHSA-2021:4702
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-8130 6.4

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.

Record
UBUNTU-CVE-2020-8130
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2020-0121 No score

Updated ruby-rake packages fix security vulnerability

Updated ruby-rake package fixes security vulnerability:

There is an OS command injection vulnerability in Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character (CVE-2020-8130).

Record
MGASA-2020-0121
Updated
2026-11-02
OSVopenSUSE-SU-2020:0395-1 No score

Recommended update for ruby2.5

This update for ruby2.5 toversion 2.5.7 fixes the following issues:

ruby 2.5 was updated to version 2.5.7

  • CVE-2020-8130: Fixed a command injection in intree copy of rake (bsc#1164804).
  • CVE-2019-16255: Fixed a code injection vulnerability of Shell#[] and Shell#test (bsc#1152990).
  • CVE-2019-16254: Fixed am HTTP response splitting in WEBrick (bsc#1152992).
  • CVE-2019-15845: Fixed a null injection vulnerability of File.fnmatch and File.fnmatch? (bsc#1152994).
  • CVE-2019-16201: Fixed a regular expression denial of service of WEBrick Digest access authentication (bsc#1152995).
  • CVE-2012-6708: Fixed an XSS in JQuery
  • CVE-2015-9251: Fixed an XSS in JQuery
  • Fixed unit tests (bsc#1140844)
  • Removed some unneeded test files (bsc#1162396).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0395-1
Updated
2026-11-02
OSVSUSE-SU-2020:0737-1 No score

Recommended update for ruby2.5

This update for ruby2.5 toversion 2.5.7 fixes the following issues:

ruby 2.5 was updated to version 2.5.7

  • CVE-2020-8130: Fixed a command injection in intree copy of rake (bsc#1164804).
  • CVE-2019-16255: Fixed a code injection vulnerability of Shell#[] and Shell#test (bsc#1152990).
  • CVE-2019-16254: Fixed am HTTP response splitting in WEBrick (bsc#1152992).
  • CVE-2019-15845: Fixed a null injection vulnerability of File.fnmatch and File.fnmatch? (bsc#1152994).
  • CVE-2019-16201: Fixed a regular expression denial of service of WEBrick Digest access authentication (bsc#1152995).
  • CVE-2012-6708: Fixed an XSS in JQuery
  • CVE-2015-9251: Fixed an XSS in JQuery
  • Fixed unit tests (bsc#1140844)
  • Removed some unneeded test files (bsc#1162396).
Record
SUSE-SU-2020:0737-1
Updated
2026-11-02
OSVSUSE-SU-2022:3212-1 No score

Security update for rubygem-rake

This update for rubygem-rake fixes the following issues:

  • CVE-2020-8130: Fixed a command injection when supplying a filename that began with the pipe character (bsc#1164804).
Record
SUSE-SU-2022:3212-1
Updated
2026-11-02
OSVUSN-4295-1 No score

rake vulnerability

It was discovered that Rake incorrectly handled certain files. An attacker could use this issue to possibly execute arbitrary commands.

Record
USN-4295-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rake
RubyGems
 through 12.3.2
12.3.3
rake
Debian:12
 before 12.3.3-1
12.3.3-1
rake
Debian:13
 before 12.3.3-1
12.3.3-1
rake
Debian:14
 before 12.3.3-1
12.3.3-1
rake
Debian:8
 before 10.3.2-2+deb8u1, plus listed versions
10.3.2-2
10.3.2-2+deb8u1
rake
RubyGems
 before 12.3.3, plus listed versions
0.4.100.4.110.4.120.4.130.4.14
Show 45 moreShow less
0.4.150.4.80.4.90.5.00.5.30.5.40.6.00.6.20.7.00.7.10.7.20.7.30.8.00.8.10.8.20.8.30.8.40.8.50.8.60.8.70.9.00.9.0.beta.00.9.0.beta.10.9.0.beta.20.9.0.beta.40.9.0.beta.50.9.10.9.20.9.2.20.9.30.9.3.beta.10.9.3.beta.20.9.3.beta.30.9.3.beta.40.9.40.9.50.9.610.0.010.0.0.beta.110.0.0.beta.210.0.110.0.210.0.310.0.410.1.0
12.3.3
ruby-rake
Mageia:7
 before 12.3.0-21.mga7
12.3.0-21.mga7
python-ecdsa
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:0.13.3-2.el7pc
0:0.13.3-2.el7pc
python3-ecdsa
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:0.13.3-2.el7pc
0:0.13.3-2.el7pc
python-ecdsa
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:0.13.3-2.el7pc
0:0.13.3-2.el7pc
Show 35 moreShow less
Affected packages
PackageAffectedFixed
python3-ecdsa
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:0.13.3-2.el7pc
0:0.13.3-2.el7pc
tfm-rubygem-activerecord-session_store
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:2.0.0-1.el7sat
0:2.0.0-1.el7sat
satellite
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:6.10.0-3.el7sat
0:6.10.0-3.el7sat
satellite
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:6.10.0-3.el7sat
0:6.10.0-3.el7sat
candlepin
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:4.0.9-1.el7sat
0:4.0.9-1.el7sat
python-pyyaml
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:5.4.1-1.el7pc
0:5.4.1-1.el7pc
python3-pyyaml
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:5.4.1-1.el7pc
0:5.4.1-1.el7pc
python-pyyaml
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:5.4.1-1.el7pc
0:5.4.1-1.el7pc
python3-pyyaml
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:5.4.1-1.el7pc
0:5.4.1-1.el7pc
tfm-rubygem-nokogiri
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:1.11.3-2.el7sat
0:1.11.3-2.el7sat
tfm-rubygem-nokogiri
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:1.11.3-2.el7sat
0:1.11.3-2.el7sat
satellite-capsule
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:6.10.0-3.el7sat
0:6.10.0-3.el7sat
foreman
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:2.5.2.17-2.el7sat
0:2.5.2.17-2.el7sat
foreman
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:2.5.2.17-2.el7sat
0:2.5.2.17-2.el7sat
python-aiohttp
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:3.7.4-1.el7pc
0:3.7.4-1.el7pc
python-aiohttp
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:3.7.4-1.el7pc
0:3.7.4-1.el7pc
tfm-rubygem-actionpack
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:6.0.3.7-1.el7sat
0:6.0.3.7-1.el7sat
tfm-rubygem-rails
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:6.0.3.7-1.el7sat
0:6.0.3.7-1.el7sat
python3-django
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:2.2.24-1.el7pc
0:2.2.24-1.el7pc
python3-django
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:2.2.24-1.el7pc
0:2.2.24-1.el7pc
tfm-rubygem-puma
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:5.3.2-1.el7sat
0:5.3.2-1.el7sat
tfm-rubygem-addressable
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:2.8.0-1.el7sat
0:2.8.0-1.el7sat
python-urllib3
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:1.26.5-1.el7pc
0:1.26.5-1.el7pc
python3-urllib3
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:1.26.5-1.el7pc
0:1.26.5-1.el7pc
python-urllib3
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:1.26.5-1.el7pc
0:1.26.5-1.el7pc
python3-urllib3
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:1.26.5-1.el7pc
0:1.26.5-1.el7pc
ruby2.5
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 7 CVEs
 before 2.5.7-4.8.1
2.5.7-4.8.1
ruby2.5
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 7 CVEs
 before 2.5.7-4.8.1
2.5.7-4.8.1
ruby2.5
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 7 CVEs
 before 2.5.7-4.8.1
2.5.7-4.8.1
ruby2.5
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 7 CVEs
 before 2.5.7-4.8.1
2.5.7-4.8.1
ruby2.5
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 7 CVEs
 before 2.5.7-4.8.1
2.5.7-4.8.1
rubygem-rake
SUSE:Linux Enterprise Module for Containers 12
 before 10.3.2-9.7.1
10.3.2-9.7.1
rake
Ubuntu:16.04:LTS
 before 10.5.0-2ubuntu0.1, plus listed versions
10.4.2-110.4.2-210.5.0-2
10.5.0-2ubuntu0.1
rake
Ubuntu:18.04:LTS
 before 12.3.1-1ubuntu0.1, plus listed versions
12.0.0-112.3.0-112.3.0-1ubuntu112.3.1-1
12.3.1-1ubuntu0.1
ruby2.5
openSUSE:Leap 15.1
From an advisory covering 7 CVEs
 before 2.5.7-lp151.4.6.1
2.5.7-lp151.4.6.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-8130 is a medium vulnerability (CVSS 6.4) in Ruby-lang Rake, published February 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.36%, the 71st percentile. Fixed in rake 12.3.3.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 29 versions and 426 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open