{"id":"CVE-2014-5002","aliases":["EUVD-2018-0157","GHSA-94cq-7ccq-cmcm"],"status":"published","title":"lynx doesn't properly sanitize user input and exposes database password to unauthorized users","description":"The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00522,"percentile":0.44524,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-255"],"published":"2018-01-10T18:00:00Z","modified":"2026-06-17T00:10:54Z","fixes":[{"ecosystem":"RubyGems","package":"lynx","fixed_in":["1.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.0"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}],"versions":["0.0.1","0.0.2","0.1.0","0.2.0","0.2.1","0.3.0","0.4.0"]}],"products":[{"vendor":"lynx_project","product":"lynx"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2014/07/07/23","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/07/17/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","web"]},{"url":"https://github.com/panthomakos/lynx/issues/3","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"http://www.vapid.dhs.org/advisories/lynx-0.2.0.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5002","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lynx/CVE-2014-5002.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-94cq-7ccq-cmcm"},{"url":"https://github.com/panthomakos/lynx","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2014-5002","description":"The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.","status":"published","published":"2018-01-10T18:00:00Z","modified":"2024-08-06T11:34:37.349Z","updated_at":"2026-11-02T14:33:41.889751Z"}],"euvd":[{"id":"EUVD-2018-0157","description":"The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.","status":"published","published":"2018-01-10T18:00:00Z","modified":"2024-08-06T11:34:37Z","updated_at":"2026-11-03T01:57:03.789124Z"}],"ghsa":[{"id":"GHSA-94cq-7ccq-cmcm","title":"lynx doesn't properly sanitize user input and exposes database password to unauthorized users","description":"The lynx gem prior to 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.\n\nAs of version 1.0.0, lynx no longer supports a `--password` option. Passwords are only configured in a configuration file, so it's no longer possible to expose passwords on the command line.","status":"published","published":"2018-01-24T17:10:45Z","modified":"2023-09-05T21:14:07Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2014-5002","description":"The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.","status":"published","published":"2018-01-10T18:29:00.777Z","modified":"2026-06-17T00:10:54.13Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-255"],"updated_at":"2026-11-02T14:02:59.001778Z"}],"osv":[{"id":"GHSA-94cq-7ccq-cmcm","title":"lynx doesn't properly sanitize user input and exposes database password to unauthorized users","description":"The lynx gem prior to 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.\n\nAs of version 1.0.0, lynx no longer supports a `--password` option. Passwords are only configured in a configuration file, so it's no longer possible to expose passwords on the command line.","status":"published","published":"2018-01-24T17:10:45Z","modified":"2024-02-16T08:18:11.775966Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}