CVE-2025-54314: rubyonrails thor OS Command Injection
CVSS: 2.8v3.1LowDeferred
AliasesUBUNTU-CVE-2025-54314CGA-6772-wffg-3p2vCGA-6jgq-hj3v-xhq6CGA-7h68-hh7v-7pq3CGA-p5cw-3phj-g56rCGA-q28x-788c-hv4wCGA-q496-xvrc-3qj2CGA-qmv5-m894-vrqpCGA-xhrr-fg4g-w89wopenSUSE-SU-2025:15382-1openSUSE-SU-2026:10366-1CGA-2hjg-5q3c-w8qxCGA-33wp-wwc8-3mhgCGA-35m3-685f-85rxCGA-3rxc-c8v6-g79jCGA-439f-88w8-wchgCGA-44cx-6hrh-24w8CGA-495f-qx2f-mx3jCGA-4gqh-9hgx-hr43CGA-4hpm-rxgh-f67hCGA-57f3-7639-76mrCGA-5vpm-q494-7rrfCGA-6gfq-h4jx-9g3wCGA-6xf3-9jj9-jpmgCGA-89fg-2hwq-pwm8CGA-cc5h-rqf6-r246CGA-ch4g-69j6-v5jcCGA-cpvp-mg8c-3q76CGA-fgrc-f96v-qc84CGA-hc75-jhp5-c9q8CGA-hpwg-g9qg-vqhgCGA-hw87-rj35-r27wCGA-jfpx-f5wc-2xv7CGA-mvv9-8vrp-7gp3CGA-p8hc-wwp4-wmjjGHSA-mqcp-p2hv-vw6xCGA-q695-fpm3-67j6CGA-qf27-fmf6-89gmCGA-r9mq-934x-gm48CGA-rvfq-4vp2-2925CGA-vp7q-j7pp-7w6rCGA-vwvj-rm7x-jrh6CGA-wj3g-m33g-rjmpCGA-wjwq-rh94-4mvvCGA-wqp7-xv6v-5v66CGA-wrj2-494g-m8hhCGA-x92q-q9qh-4jwgCGA-xxrq-242f-grg4
Published 20-07-2025Last modified 10-08-2025
Vulnerability summary
CVE-2025-54314 is a low (CVSS 2.8) OS Command Injection vulnerability in rubyonrails thor. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.7% of scored vulnerabilities.
CVSS score
2.8/10
010
Low · v3.1 (CVE.org)EPSS score
0.18%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 5Timeline
- 20-07-2025PublishedVulnerability first disclosed.
- 10-08-2025Last modifiedVulnerability information updated.
Description
Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."
CVSS metrics
6 scores · 6 sources · 1 versionLow 2.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:NSources6 sources · 2.8–7.8
- OSV · UbuntuEcosystem advisory · calculated2.8LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated2.8LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated2.8LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
- OSV · RubygemsEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HDiffers
- NVDNIST2.8LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
+0.01 pp
From 0.17% on 19-09-2026
19-09-202619-10-2026
EPSS score0.18%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard22 products
- kube-fluentd-operator< 1.18.2-r42
- kube-fluentd-operator-compat< 1.18.2-r42
- kube-fluentd-operator-default-config< 1.18.2-r42
- kube-fluentd-operator-oci-entrypoint< 1.18.2-r42
- ruby3.2-rails-7.1< 7.1.5.1-r10
Wolfi4 products
- kube-fluentd-operator< 1.18.2-r42
- kube-fluentd-operator-compat< 1.18.2-r42
- kube-fluentd-operator-default-config< 1.18.2-r42
- kube-fluentd-operator-oci-entrypoint< 1.18.2-r42
Opensuse1 product
- rubygem-thor&distro=openSUSE Tumbleweed< 1.4.0-1.1 | < 1.4.0-1.3
RubyGems1 product
- thor< 1.4.0
Rubyonrails1 product
- thor< 1.4.0
Ubuntu1 product
- ruby-thorAll versions (No fix recorded)
6 vendors · 30 products
References
12 links
Show all 12 references
- github.com/rails/thorPACKAGE