Every CVE Search/ Get API key

CVE-2021-21289

Command Injection Vulnerability in Mechanize

7.4 HighFix available

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

3.55%Up 1.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.4

Command Injection Vulnerability in Mechanize

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.

Record
CVE-2021-21289
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2021-0569 7.4

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.

Record
EUVD-2021-0569
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-qrqm-fpv6-6r8g 7.4

Command Injection Vulnerability in Mechanize

This security advisory has been created for public disclosure of a Command Injection vulnerability that was responsibly reported by @kyoshidajp (Katsuhiko YOSHIDA).

Impact

Mechanize >= v2.0, < v2.7.7 allows for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls:

  • Mechanize::CookieJar#load: since v2.0 (see 208e3ed)
  • Mechanize::CookieJar#save_as: since v2.0 (see 5b776a4)
  • Mechanize#download: since v2.2 (see dc91667)
  • Mechanize::Download#save and #save! since v2.1 (see 98b2f51, bd62ff0)
  • Mechanize::File#save and #save_as: since v2.1 (see 2bf7519)
  • Mechanize::FileResponse#read_body: since v2.0 (see 01039f5)

Patches

These vulnerabilities are patched in Mechanize v2.7.7.

Workarounds

No workarounds are available. We recommend upgrading to v2.7.7 or later.

References

See https://docs.rubocop.org/rubocop/cops_security.html#securityopen for background on why Kernel.open should not be used with untrusted input.

For more information

If you have any questions or comments about this advisory, please open an issue in sparklemotion/mechanize.

Record
GHSA-qrqm-fpv6-6r8g
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weakness
CWE-78
Updated
2026-11-02
NVD 7.4

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.

Record
CVE-2021-21289
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 2.0
7.6 HighAV:N/AC:H/Au:N/C:C/I:C/A:C
Weakness
CWE-78
Updated
2026-11-02
OSV 8.3

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.

Record
CVE-2021-21289
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-21289 8.3

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.

Record
DEBIAN-CVE-2021-21289
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-qrqm-fpv6-6r8g 7.4

Command Injection Vulnerability in Mechanize

This security advisory has been created for public disclosure of a Command Injection vulnerability that was responsibly reported by @kyoshidajp (Katsuhiko YOSHIDA).

Impact

Mechanize >= v2.0, < v2.7.7 allows for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls:

  • Mechanize::CookieJar#load: since v2.0 (see 208e3ed)
  • Mechanize::CookieJar#save_as: since v2.0 (see 5b776a4)
  • Mechanize#download: since v2.2 (see dc91667)
  • Mechanize::Download#save and #save! since v2.1 (see 98b2f51, bd62ff0)
  • Mechanize::File#save and #save_as: since v2.1 (see 2bf7519)
  • Mechanize::FileResponse#read_body: since v2.0 (see 01039f5)

Patches

These vulnerabilities are patched in Mechanize v2.7.7.

Workarounds

No workarounds are available. We recommend upgrading to v2.7.7 or later.

References

See https://docs.rubocop.org/rubocop/cops_security.html#securityopen for background on why Kernel.open should not be used with untrusted input.

For more information

If you have any questions or comments about this advisory, please open an issue in sparklemotion/mechanize.

Record
GHSA-qrqm-fpv6-6r8g
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weakness
CWE-78
Updated
2026-11-02
OSVUBUNTU-CVE-2021-21289 7.4

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.

Record
UBUNTU-CVE-2021-21289
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2021-0124 No score

Updated ruby-mechanize packages fix a security vulnerability

In Mechanize, from v2.0.0 until v2.7.7, there is a command injection vulnerability. Affected versions of Mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel#open method (CVE-2021-21289).

Record
MGASA-2021-0124
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mechanize
RubyGems
 2.0.0 up to 2.7.7
2.7.7
ruby-mechanize
Debian:12
 before 2.7.7-1
2.7.7-1
ruby-mechanize
Debian:13
 before 2.7.7-1
2.7.7-1
ruby-mechanize
Debian:14
 before 2.7.7-1
2.7.7-1
ruby-mechanize
Debian:9
 before 2.7.5-1+deb9u1, plus listed versions
2.7.5-1
2.7.5-1+deb9u1
mechanize
RubyGems
 2.0.0 up to 2.7.7, plus listed versions
2.02.0.12.12.1.12.1.pre.1
Show 14 moreShow less
2.22.2.12.32.42.52.5.12.6.02.7.02.7.12.7.22.7.32.7.42.7.52.7.6
2.7.7
ruby-mechanize
Mageia:7
 before 2.7.6-2.1.mga7
2.7.6-2.1.mga7
ruby-mechanize
Mageia:8
 before 2.7.6-3.1.mga8
2.7.6-3.1.mga8
ruby-mechanize
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.7.3-1
 None known
ruby-mechanize
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.7.5-12.7.5-2
 None known
ruby-mechanize
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.7.6-1
 None known
ruby-mechanize
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.7.7-12.7.7-3
 None known

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-21289 is a high vulnerability (CVSS 7.4) in Mechanize Project Mechanize, published February 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.55%, the 89th percentile. Fixed in mechanize 2.7.7.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open