Every CVE Search/ Get API key

CVE-2009-4492

WEBrick Improper Input Validation vulnerability

7.5 HighPublic exploitFix available

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Exploit likelihood

16.2%Up 5.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Record
CVE-2009-4492
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Record
CVE-2009-4492
Updated
2026-11-02
EUVDEUVD-2017-0178 No score

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Record
EUVD-2017-0178
Updated
2026-11-03
GitHub AdvisoriesGHSA-6mq2-37j5-w6r6 No score

WEBrick Improper Input Validation vulnerability

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Record
GHSA-6mq2-37j5-w6r6
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-6mq2-37j5-w6r6 No score

WEBrick Improper Input Validation vulnerability

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Record
GHSA-6mq2-37j5-w6r6
Weakness
CWE-20
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
webrick
RubyGems
 through 1.3.1
1.4.0
webrick
RubyGems
 before 1.4.0, plus listed versions
1.3.11.4.0.beta1
1.4.0
irb
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-debuginfo
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-devel
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-docs
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-libs
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-mode
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-tcltk
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
Show 34 moreShow less
Affected packages
PackageAffectedFixed
irb
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-debuginfo
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-devel
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-docs
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-libs
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-mode
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-tcltk
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
irb
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-debuginfo
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-devel
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-docs
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-libs
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-mode
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-tcltk
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
irb
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-debuginfo
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-devel
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-docs
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-libs
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-mode
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby-tcltk
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:1.8.1-16.el4
0:1.8.1-16.el4
ruby
Red Hat:enterprise_linux:5::server
From an advisory covering 5 CVEs
 before 0:1.8.5-19.el5_6.1
0:1.8.5-19.el5_6.1
ruby-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 5 CVEs
 before 0:1.8.5-19.el5_6.1
0:1.8.5-19.el5_6.1
ruby-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 5 CVEs
 before 0:1.8.5-19.el5_6.1
0:1.8.5-19.el5_6.1
ruby-docs
Red Hat:enterprise_linux:5::server
From an advisory covering 5 CVEs
 before 0:1.8.5-19.el5_6.1
0:1.8.5-19.el5_6.1
ruby-irb
Red Hat:enterprise_linux:5::server
From an advisory covering 5 CVEs
 before 0:1.8.5-19.el5_6.1
0:1.8.5-19.el5_6.1
ruby-libs
Red Hat:enterprise_linux:5::server
From an advisory covering 5 CVEs
 before 0:1.8.5-19.el5_6.1
0:1.8.5-19.el5_6.1
ruby-mode
Red Hat:enterprise_linux:5::server
From an advisory covering 5 CVEs
 before 0:1.8.5-19.el5_6.1
0:1.8.5-19.el5_6.1
ruby-rdoc
Red Hat:enterprise_linux:5::server
From an advisory covering 5 CVEs
 before 0:1.8.5-19.el5_6.1
0:1.8.5-19.el5_6.1
ruby-ri
Red Hat:enterprise_linux:5::server
From an advisory covering 5 CVEs
 before 0:1.8.5-19.el5_6.1
0:1.8.5-19.el5_6.1
ruby-tcltk
Red Hat:enterprise_linux:5::server
From an advisory covering 5 CVEs
 before 0:1.8.5-19.el5_6.1
0:1.8.5-19.el5_6.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBRuby 1.9.1 - WEBrick 'Terminal Escape Sequence in Logs' Command Injection2010-01-11

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-4492 is a high vulnerability (CVSS 7.5) in Ruby-lang Webrick, published January 13, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 16.2%, the 96th percentile. Fixed in webrick 1.4.0.

References

Show 39 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open