high7.8
CVE-2025-54314
Withdrawn Advisory: Thor can construct an unsafe shell command from library input.
Impact
### Withdrawn Advisory This advisory has been withdrawn because the method described can only be used with arguments that are controlled by Thor, and an external attacker cannot access the functionality described in the body of the CVE. This link is maintained to preserve external references. ### Original Description Thor before 1.4.0 can construct an unsafe shell command from library input.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | thor | < 1.4.0 | 1.4.0 |
Affected products
| Product | Affected versions |
|---|---|
| Thor | before 1.4.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/github/advisory-database/pull/5912#issuecomment-3169255309
- https://github.com/rails/thor/commit/536b79036a0efb765c1899233412e7b1ca94abfa
- https://github.com/rails/thor/pull/897
- https://github.com/rails/thor/releases/tag/v1.4.0
- https://hackerone.com/reports/3260153
- https://github.com/advisories/GHSA-mqcp-p2hv-vw6x
- https://nvd.nist.gov/vuln/detail/CVE-2025-54314
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/thor/CVE-2025-54314.yml