{"id":"CVE-2022-24803","aliases":["DEBIAN-CVE-2022-24803","EUVD-2022-1539","GHSA-v222-6mr4-qj29","UBUNTU-CVE-2022-24803"],"status":"published","title":"Command Injection vulnerability in asciidoctor-include-ext","description":"Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02686,"percentile":0.85977,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2022-03-31T23:27:15Z","modified":"2026-11-04T20:01:08Z","fixes":[{"ecosystem":"RubyGems","package":"asciidoctor-include-ext","fixed_in":["0.4.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-asciidoctor-include-ext","fixed_in":["0.4.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-asciidoctor-include-ext","fixed_in":["0.4.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-asciidoctor-include-ext","fixed_in":["0.4.0-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"asciidoctor-include-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-asciidoctor-include-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-asciidoctor-include-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-asciidoctor-include-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-2"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"asciidoctor-include-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}],"versions":["0.1.0","0.1.1","0.2.0","0.3.0","0.3.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-asciidoctor-include-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-asciidoctor-include-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ruby-asciidoctor-include-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.0+gh-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ruby-asciidoctor-include-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.0+gh-1","0.4.0+gh-2"]}],"products":[{"vendor":"asciidoctor-include-ext_project","product":"asciidoctor-include-ext"},{"vendor":"jirutka","product":"asciidoctor-include-ext"}],"references":[{"url":"https://github.com/jirutka/asciidoctor-include-ext/security/advisories/GHSA-v222-6mr4-qj29","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/jirutka/asciidoctor-include-ext/commit/c7ea001a597c7033575342c51483dab7b87ae155","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/jirutka/asciidoctor-include-ext/commit/cbaccf3de533cbca224bf61d0b74e4b84d41d8ee","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24803","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/asciidoctor-include-ext/CVE-2022-24803.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v222-6mr4-qj29"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24803.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-24803","tags":["advisory"]},{"url":"https://github.com/jirutka/asciidoctor-include-ext","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-24803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24803","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-24803","title":"Command Injection vulnerability in asciidoctor-include-ext","description":"Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.","status":"published","published":"2022-03-31T23:30:14Z","modified":"2025-04-22T18:17:46.997Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-1539","description":"Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.","status":"published","published":"2022-03-31T23:30:14Z","modified":"2025-04-22T18:17:46Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:15.026784Z"}],"ghsa":[{"id":"GHSA-v222-6mr4-qj29","title":"Command Injection vulnerability in asciidoctor-include-ext","description":"### Impact\n\nApplications using [Asciidoctor (Ruby)](https://github.com/asciidoctor/asciidoctor) with [asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext) (prior to version 0.4.0), which render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. ~~This attack is possible even when `allow-uri-read` is disabled!~~ (EDIT: it’s not)\n\n\n### Patches\n\nThe vulnerability has been fixed in commit c7ea001 (and further improved in cbaccf3), which is included in version [0.4.0](https://rubygems.org/gems/asciidoctor-include-ext/versions/0.4.0).\n\n### Workarounds\n\n```rb\nrequire 'asciidoctor/include_ext'\n\nclass Asciidoctor::IncludeExt::IncludeProcessor\n  # Overrides superclass private method to mitigate Command Injection\n  # vulnerability in asciidoctor-include-ext \u003c0.4.0.\n  def target_uri?(target)\n    target.downcase.start_with?('http://', 'https://') \\\n      \u0026\u0026 URI.parse(target).is_a?(URI::HTTP)\n  rescue URI::InvalidURIError\n    false\n  end\nend\n```\n\n### References\n\n* https://sakurity.com/blog/2015/02/28/openuri.html\n\n### Credits\n\nThis vulnerability was discovered by Joern Schneeweisz from the GitLab Security Research Team.\n\n\n### For more information\n\nSee commit message c7ea001.\n\nIf you have any questions or comments about this advisory open an issue in [jirutka/asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext/issues/).","status":"published","published":"2022-03-31T23:27:15Z","modified":"2023-05-04T19:32:33Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:36:52.310293Z"}],"nvd":[{"id":"CVE-2022-24803","description":"Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.","status":"published","published":"2022-04-01T00:15:08.95Z","modified":"2026-06-17T04:32:33.3Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:14.706146Z"}],"osv":[{"id":"CVE-2022-24803","title":"Command Injection vulnerability in asciidoctor-include-ext","description":"Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.","status":"published","published":"2022-03-31T23:30:14Z","modified":"2026-10-28T02:31:03.673381602Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-24803","description":"Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.","status":"published","published":"2022-04-01T00:15:08.95Z","modified":"2026-11-03T08:00:19.53141705Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"GHSA-v222-6mr4-qj29","title":"Command Injection vulnerability in asciidoctor-include-ext","description":"### Impact\n\nApplications using [Asciidoctor (Ruby)](https://github.com/asciidoctor/asciidoctor) with [asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext) (prior to version 0.4.0), which render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. ~~This attack is possible even when `allow-uri-read` is disabled!~~ (EDIT: it’s not)\n\n\n### Patches\n\nThe vulnerability has been fixed in commit c7ea001 (and further improved in cbaccf3), which is included in version [0.4.0](https://rubygems.org/gems/asciidoctor-include-ext/versions/0.4.0).\n\n### Workarounds\n\n```rb\nrequire 'asciidoctor/include_ext'\n\nclass Asciidoctor::IncludeExt::IncludeProcessor\n  # Overrides superclass private method to mitigate Command Injection\n  # vulnerability in asciidoctor-include-ext \u003c0.4.0.\n  def target_uri?(target)\n    target.downcase.start_with?('http://', 'https://') \\\n      \u0026\u0026 URI.parse(target).is_a?(URI::HTTP)\n  rescue URI::InvalidURIError\n    false\n  end\nend\n```\n\n### References\n\n* https://sakurity.com/blog/2015/02/28/openuri.html\n\n### Credits\n\nThis vulnerability was discovered by Joern Schneeweisz from the GitLab Security Research Team.\n\n\n### For more information\n\nSee commit message c7ea001.\n\nIf you have any questions or comments about this advisory open an issue in [jirutka/asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext/issues/).","status":"published","published":"2022-03-31T23:27:15Z","modified":"2023-11-08T04:08:37.142159Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"UBUNTU-CVE-2022-24803","description":"Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.","status":"published","published":"2022-04-01T00:15:00Z","modified":"2026-11-04T20:01:08.604991351Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T20:16:32.566315Z"}]}}