CVE-2019-15224
rest-client Gem Contains Malicious Code
CVE-2019-15224 is a critical vulnerability (CVSS 9.8) in Rest-client Project Rest-client, published August 19, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.55%, the 89th percentile. Fixed in rest-client 1.7.0.
- Severity
- 9.8 CriticalCVSS 3.0, NVD
- Exploit chance
- 3.55%EPSS, 89th percentile
- Exploitation
- None known1 public exploit
- Fixed in
1.7.0rest-client +12 more
Description
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rest-clientRubyGems | 1.6.10 to 1.6.13 | 1.7.0 |
cron_parserRubyGems | 1.0.13 to 1.0.14 | None known |
cron_parserRubyGems | 0.1.4 to 0.1.4 | None known |
coin_baseRubyGems | All versions | None known |
blockchain_walletRubyGems | All versions | None known |
awesome-botRubyGems | All versions | None known |
doge-coinRubyGems | All versions | None known |
capistrano-colorsRubyGems | All versions | None known |
bitcoin_vanityRubyGems | All versions | None known |
coming-soonRubyGems | All versions | None known |
omniauth_amazonRubyGems | All versions | None known |
rest-clientRubyGems | 1.6.10 up to 1.7.0, plus listed versions 1.6.141.7.0.rc1 | 1.7.0 |
cron_parserRubyGems | Listed versions 0.1.4 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | chef-cft/inspec_cve_2019_15224 | 2019-08-23 |
What each source reports
NVD Score used
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.
- Record
CVE-2019-15224- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE ListNo score
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.
- Record
CVE-2019-15224- Updated
- 2026-11-02
EUVDEUVD-2019-0614No score
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.
- Record
EUVD-2019-0614- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-333g-rpr4-7hxq
rest-client Gem Contains Malicious Code
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x. Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory. These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
- Record
GHSA-333g-rpr4-7hxq- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-333g-rpr4-7hxq
rest-client Gem Contains Malicious Code
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x. Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory. These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
- Record
GHSA-333g-rpr4-7hxq- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/rest-client/rest-client/issues/713
rubygems.org/gems/rest-client/versions
nvd.nist.gov/vuln/detail/CVE-2019-15224
Show 6 moreShow less