{"id":"CVE-2013-5671","aliases":["EUVD-2017-0293","GHSA-qrgf-jqqm-x7xv"],"status":"published","title":"Code injection in dragonfly gem","description":"lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02188,"percentile":0.82544,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2014-05-12T14:00:00Z","modified":"2026-06-16T23:59:13Z","fixes":[{"ecosystem":"RubyGems","package":"dragonfly","fixed_in":["1.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"dragonfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"fog-dragonfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.9.15"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"dragonfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}],"versions":["0.1.0","0.1.1","0.1.4","0.1.5","0.1.6","0.2.1","0.3.0","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.8.0","0.8.1","0.8.2","0.8.4","0.8.5","0.8.6","0.9.0","0.9.1","0.9.10","0.9.11","0.9.12","0.9.13","0.9.14","0.9.15","0.9.2","0.9.3","0.9.4","0.9.5","0.9.8","0.9.9"]},{"source":"osv","ecosystem":"RubyGems","package":"fog-dragonfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.9.15"}]}],"versions":["0.8.1","0.8.2"]}],"products":[{"vendor":"mark_evans","product":"fog-dragonfly"}],"references":[{"url":"http://seclists.org/fulldisclosure/2013/Sep/18","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","web"]},{"url":"http://seclists.org/oss-sec/2013/q3/528","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","web"]},{"url":"http://www.vapid.dhs.org/advisories/fog-dragonfly-0.8.2-cmd-inj.html","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://seclists.org/oss-sec/2013/q3/526","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","web"]},{"url":"http://www.osvdb.org/96798","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5671","tags":["advisory"]},{"url":"https://github.com/markevans/dragonfly/issues/520","tags":["web"]},{"url":"https://github.com/github/advisory-database/pull/486","tags":["web"]},{"url":"https://web.archive.org/web/20201208033320/http://www.vapid.dhs.org/advisories/fog-dragonfly-0.8.2-cmd-inj.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qrgf-jqqm-x7xv"},{"url":"https://github.com/markevans/dragonfly","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2013-5671","description":"lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.","status":"published","published":"2014-05-12T14:00:00Z","modified":"2024-08-06T17:15:21.472Z","updated_at":"2026-11-02T14:34:55.508771Z"}],"euvd":[{"id":"EUVD-2017-0293","description":"lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.","status":"published","published":"2014-05-12T14:00:00Z","modified":"2024-08-06T17:15:21Z","updated_at":"2026-11-03T01:56:28.286421Z"}],"ghsa":[{"id":"GHSA-qrgf-jqqm-x7xv","title":"Code injection in dragonfly gem","description":"`lib/dragonfly/imagemagickutils.rb` in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2023-11-08T05:03:28Z","cwes":["CWE-74"],"updated_at":"2026-11-02T14:37:16.721714Z"}],"nvd":[{"id":"CVE-2013-5671","description":"lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.","status":"published","published":"2014-05-12T14:55:05.757Z","modified":"2026-06-16T23:59:13.677Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:02:50.049023Z"}],"osv":[{"id":"GHSA-qrgf-jqqm-x7xv","title":"Code injection in dragonfly gem","description":"`lib/dragonfly/imagemagickutils.rb` in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2024-12-08T05:34:08.990355Z","cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:54.760124Z"}]}}