{"id":"CVE-2013-0175","aliases":["EUVD-2017-0282","GHSA-pchc-949f-53m5","openSUSE-SU-2024:11339-1","openSUSE-SU-2024:13164-1","openSUSE-SU-2024:14173-1","openSUSE-SU-2025:15122-1","openSUSE-SU-2026:10355-1"],"status":"published","title":"Improper Input Validation in multi_xml","description":"multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03726,"percentile":0.89873,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2013-04-25T23:00:00Z","modified":"2026-06-16T23:48:54Z","fixes":[{"ecosystem":"RubyGems","package":"multi_xml","fixed_in":["0.5.2"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-multi_xml","fixed_in":["0.6.0-1.23"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rubygem-multi_xml","fixed_in":["0.6.0-1.27","0.6.0-1.29","0.6.0-1.31"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"multi_xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"multi_xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}],"versions":["0.0.1","0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.2.0","0.2.1","0.2.2","0.3.0","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-multi_xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-1.23"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-multi_xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-1.27"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-multi_xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-1.29"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-multi_xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-1.31"}]}]}],"products":[{"vendor":"erik_michaels-ober","product":"multi_xml"},{"vendor":"grape_project","product":"grape"}],"references":[{"url":"https://github.com/sferik/multi_xml/pull/34","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://gist.github.com/nate/d7f6d9f4925f413621aa","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2013/01/11/9","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://groups.google.com/forum/?fromgroups=#%21topic/ruby-grape/fthDkMgIOa0","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://news.ycombinator.com/item?id=5040457","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0175","tags":["advisory"]},{"url":"https://groups.google.com/forum/?fromgroups=#!topic/ruby-grape/fthDkMgIOa0","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2013/01/11/9","tags":["web"]},{"url":"https://github.com/sferik/multi_xml/commit/c94b136d06822514fc2e99dc851e6c4eeb4c8bdf","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pchc-949f-53m5"},{"url":"https://github.com/sferik/multi_xml","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0175","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZTB6COKJCHLLO7JZY6ESFLTE672O2H4L/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-0175","description":"multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","status":"published","published":"2013-04-25T23:00:00Z","modified":"2024-08-06T14:18:09.043Z","updated_at":"2026-11-02T14:34:59.551717Z"}],"euvd":[{"id":"EUVD-2017-0282","description":"multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","status":"published","published":"2013-04-25T23:00:00Z","modified":"2024-08-06T14:18:09Z","updated_at":"2026-11-03T01:56:45.704567Z"}],"ghsa":[{"id":"GHSA-pchc-949f-53m5","title":"Improper Input Validation in multi_xml","description":"multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2023-10-10T19:11:37Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:08.847568Z"}],"nvd":[{"id":"CVE-2013-0175","description":"multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","status":"published","published":"2013-04-25T23:55:01.41Z","modified":"2026-06-16T23:48:54.593Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:25.704053Z"}],"osv":[{"id":"GHSA-pchc-949f-53m5","title":"Improper Input Validation in multi_xml","description":"multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2024-12-04T05:42:01.958665Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"openSUSE-SU-2024:11339-1","title":"ruby2.7-rubygem-multi_xml-0.6.0-1.14 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-multi_xml-0.6.0-1.14 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:04:12.468564Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:13164-1","title":"ruby3.2-rubygem-multi_xml-0.6.0-1.23 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-multi_xml-0.6.0-1.23 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:05:10.717254Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:14173-1","title":"ruby3.3-rubygem-multi_xml-0.6.0-1.27 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-multi_xml-0.6.0-1.27 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T04:26:11.142722Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15122-1","title":"ruby3.4-rubygem-multi_xml-0.6.0-1.29 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-multi_xml-0.6.0-1.29 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T02:28:26.250268Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10355-1","title":"ruby4.0-rubygem-multi_xml-0.6.0-1.31 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-multi_xml-0.6.0-1.31 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:44:10.579986Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}