CVE-2025-54314

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-54314
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-54314.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-54314
Aliases
Downstream
Related
Withdrawn
2025-08-10T00:19:19Z
Published
2025-07-20T03:15:22Z
Modified
2025-08-10T03:07:57.717514Z
Summary
[none]
Details

Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."

References

Affected packages

Debian:11 / ruby-thor

Package

Name
ruby-thor
Purl
pkg:deb/debian/ruby-thor?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.1-1
1.2.1-1
1.2.1-2
1.2.2-1
1.3.0-1
1.3.1-1
1.3.2-1
1.3.2-2
1.3.2-2.1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / ruby-thor

Package

Name
ruby-thor
Purl
pkg:deb/debian/ruby-thor?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.2.1-2
1.2.2-1
1.3.0-1
1.3.1-1
1.3.2-1
1.3.2-2
1.3.2-2.1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / ruby-thor

Package

Name
ruby-thor
Purl
pkg:deb/debian/ruby-thor?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.2-2.1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / ruby-thor

Package

Name
ruby-thor
Purl
pkg:deb/debian/ruby-thor?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.2-2.1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/rails/thor

Affected ranges

Type
GIT
Repo
https://github.com/rails/thor
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
518ae0f49bb1c3dc2226607c07da74b591759ed0
Fixed
536b79036a0efb765c1899233412e7b1ca94abfa

Affected versions

0.*

0.9.1
0.9.2
0.9.4
0.9.5

v0.*

v0.12.2
v0.12.3
v0.13.0
v0.13.1
v0.13.2
v0.13.3
v0.13.4
v0.13.5
v0.13.6
v0.13.7
v0.13.8
v0.14.0
v0.14.2
v0.14.3
v0.14.4
v0.14.5
v0.14.6
v0.15.0
v0.15.0.rc2
v0.15.1
v0.15.2
v0.15.4
v0.16.0
v0.17.0
v0.18.0
v0.18.1
v0.19.0
v0.19.1
v0.19.2
v0.19.3
v0.19.4
v0.20.0
v0.20.1
v0.20.2
v0.20.3

v1.*

v1.0.0
v1.0.1
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.3.1
v1.3.2