Skip to content
Fencer Intel
high 7.4

CVE-2021-21305 in the critical feed json

Code Injection vulnerability in CarrierWave

published 5y ago modified 4mo ago also GHSA-cf3w-g86h-35x4 , EUVD-2021-0545

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
13.2%
EPSS 13.2% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.

Patch / fix

  • rubygems carrierwave 1.3.2, 2.1.1
  • carrierwave_project carrierwave 1.3.2, 2.1.1
  • ruby-carrierwave Debian 12 1.3.2-1

debian advisories DEBIAN-CVE-2021-21305

  • ruby-carrierwave Ubuntu Pro 18.04 LTS 1.2.2-1ubuntu0.1~esm1
  • ruby-carrierwave Ubuntu Pro 20.04 LTS 1.3.1-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2021-21305

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2021-21305 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

13.21% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
rubygems carrierwave
<1.3.2
>=2.0.0, <2.1.1
1.3.2
2.1.1

Affected products

  • carrierwaveuploader carrierwave

Classification

Weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.