CVE-2013-1756
Dragonfly Code Injection vulnerability
CVE-2013-1756 is a high vulnerability (CVSS 7.5) in Mark Evans Dragonfly Gem, published June 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.71%, the 89th percentile. Fixed in dragonfly 0.8.6.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 3.71%EPSS, 89th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.8.6dragonfly +3 more
Description
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dragonflyRubyGems | 0.7 up to 0.8.6 | 0.8.6 |
dragonflyRubyGems | 0.9 up to 0.9.13 | 0.9.13 |
dragonflyRubyGems | 0.7 up to 0.8.6, plus listed versions 0.7.00.7.10.7.20.7.30.7.4 Show 8 moreShow less0.7.50.7.60.7.70.8.00.8.10.8.20.8.40.8.5 | 0.8.6 |
dragonflyRubyGems | 0.9 up to 0.9.13, plus listed versions 0.9.00.9.10.9.100.9.110.9.12 Show 6 moreShow less0.9.20.9.30.9.40.9.50.9.80.9.9 | 0.9.13 |
What each source reports
NVD Score used
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
- Record
CVE-2013-1756- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE ListNo score
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
- Record
CVE-2013-1756- Updated
- 2026-11-02
EUVDEUVD-2017-0276No score
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
- Record
EUVD-2017-0276- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p463-639r-q9g9No score
Dragonfly Code Injection vulnerability
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
- Record
GHSA-p463-639r-q9g9- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-p463-639r-q9g9No score
Dragonfly Code Injection vulnerability
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
- Record
GHSA-p463-639r-q9g9- Weakness
- CWE-94
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
exchange.xforce.ibmcloud.com/vulnerabilities/82476
securityfocus.com/bid/58225
github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277
groups.google.com/forum?fromgroups=
secunia.com/advisories/52380
nvd.nist.gov/vuln/detail/CVE-2013-1756
web.archive.org/web/20200229103538/http://www.securityfocus.com/bid/58225