{"id":"CVE-2019-13574","aliases":["DEBIAN-CVE-2019-13574","DLA-1948-1","DSA-4481-1","EUVD-2019-0603","GHSA-r7j3-vvh2-xrpj","OESA-2021-1150","UBUNTU-CVE-2019-13574"],"status":"published","title":"OS Command Injection in MiniMagick","description":"In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07639,"percentile":0.94607,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2019-07-12T02:31:25Z","modified":"2026-10-20T10:50:42Z","exploits":[{"source":"pocgithub","id":"masahiro331/CVE-2019-13574","title":"masahiro331/CVE-2019-13574","date":"2019-07-16","url":"https://github.com/masahiro331/CVE-2019-13574"}],"fixes":[{"ecosystem":"RubyGems","package":"mini_magick","fixed_in":["4.9.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-mini-magick","fixed_in":["4.9.2-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-mini-magick","fixed_in":["4.9.2-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-mini-magick","fixed_in":["4.9.2-1.1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"ruby-mini-magick","fixed_in":["3.8.1-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"ruby-mini-magick","fixed_in":["4.5.1-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"ruby-mini-magick","fixed_in":["4.9.2-1+deb10u1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-mini_magick","fixed_in":["4.8.0-3.oe1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"mini_magick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-mini-magick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-mini-magick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-mini-magick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-1.1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"ruby-mini-magick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-1+deb8u1"}]}],"versions":["3.8.1-1"]},{"source":"osv","ecosystem":"Debian:9","package":"ruby-mini-magick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1+deb9u1"}]}],"versions":["4.5.1-1"]},{"source":"osv","ecosystem":"Debian:10","package":"ruby-mini-magick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-1+deb10u1"}]}],"versions":["4.9.2-1"]},{"source":"osv","ecosystem":"RubyGems","package":"mini_magick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4"}]}],"versions":["1.0.1","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.5","1.3.0","1.3.1","1.3.2","1.3.3","2.0.0","2.0.1","2.0.2","2.1","2.3","3.0","3.1","3.2","3.2.1","3.3","3.4","3.5.0","3.6.0","3.7.0","3.8.0","3.8.1","4.0.0","4.0.0.rc","4.0.1","4.0.2","4.0.3","4.0.4","4.1.0","4.1.1","4.2.0","4.2.1","4.2.10","4.2.3","4.2.4","4.2.5","4.2.7","4.2.9","4.3.1","4.3.2","4.3.3","4.3.4","4.3.5","4.3.6","4.4.0","4.5.0","4.5.1","4.6.0","4.6.1","4.7.0","4.7.1","4.7.2","4.8.0","4.9.0","4.9.1","4.9.2","4.9.3"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-mini_magick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.0-3.oe1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-mini-magick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.3-1","4.3.3-2","4.3.6-2","4.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-mini-magick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.2-1","4.8.0-1","4.8.0-2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"minimagick_project","product":"minimagick"}],"references":[{"url":"https://github.com/minimagick/minimagick/releases/tag/v4.9.4","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/minimagick/minimagick/commit/4cd5081e58810d3394d27a67219e8e4e0445d851","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/minimagick/minimagick/compare/d484786...293f9bb","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://www.debian.org/security/2019/dsa-4481","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Jul/20","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00007.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13574","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mini_magick/CVE-2019-13574.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r7j3-vvh2-xrpj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13574","tags":["advisory"]},{"url":"https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4","tags":["web"]},{"url":"https://github.com/minimagick/minimagick","tags":["package"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1150","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-13574","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13574","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-13574","description":"In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.","status":"published","published":"2019-07-12T02:31:25Z","modified":"2024-08-04T23:57:39.417Z","updated_at":"2026-11-02T14:20:24.357095Z"}],"euvd":[{"id":"EUVD-2019-0603","description":"In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.","status":"published","published":"2019-07-12T02:31:25Z","modified":"2024-08-04T23:57:39Z","updated_at":"2026-11-03T02:40:42.441902Z"}],"ghsa":[{"id":"GHSA-r7j3-vvh2-xrpj","title":"OS Command Injection in MiniMagick","description":"In `lib/mini_magick/image.rb` in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because `Image.open` input is directly passed to `Kernel#open`, which accepts a `|` character followed by a command.","status":"published","published":"2019-07-18T13:19:22Z","modified":"2023-08-29T12:47:46Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2019-13574","description":"In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.","status":"published","published":"2019-07-12T03:15:10.467Z","modified":"2026-06-17T02:17:00.94Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:05:19.195714Z"}],"osv":[{"id":"CVE-2019-13574","description":"In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.","status":"published","published":"2019-07-12T03:15:10.467Z","modified":"2026-10-20T10:50:42.818768024Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13574","description":"In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.","status":"published","published":"2019-07-12T03:15:10.467Z","modified":"2026-09-21T07:02:19.88641179Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"GHSA-r7j3-vvh2-xrpj","title":"OS Command Injection in MiniMagick","description":"In `lib/mini_magick/image.rb` in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because `Image.open` input is directly passed to `Kernel#open`, which accepts a `|` character followed by a command.","status":"published","published":"2019-07-18T13:19:22Z","modified":"2024-02-19T05:32:31.104648Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"OESA-2021-1150","title":"rubygem-mini_magick security update","description":"A ruby wrapper for ImageMagick command line. Using MiniMagick the ruby processes memory remains small (it spawns ImageMagick\u0026apos;s command line program mogrify which takes up some memory as well, but is much smaller compared to RMagick).\r\n\r\nSecurity Fix(es):\r\n\r\nIn lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a \u0026apos;|\u0026apos; character followed by a command.(CVE-2019-13574)","status":"published","published":"2021-05-06T11:04:23Z","modified":"2026-08-18T01:15:29.722322923Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2019-13574","description":"In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.","status":"published","published":"2019-07-12T03:15:00Z","modified":"2025-10-24T04:47:43Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-1948-1","title":"ruby-mini-magick - security update","status":"published","published":"2019-10-07T00:00:00Z","modified":"2026-03-09T01:19:27.699337Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4481-1","title":"ruby-mini-magick - security update","status":"published","published":"2019-07-13T00:00:00Z","modified":"2026-03-09T02:09:31.771175Z","updated_at":"2026-11-02T15:46:16.862196Z"}]}}