Skip to content
OpenAdvisories
Medium USN-4295-1 1 CVE

rake vulnerability

Published Mar 3, 2020 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Rake incorrectly handled certain files.
An attacker could use this issue to possibly execute arbitrary commands.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS rake 10.5.0-2ubuntu0.1
Ubuntu · 18.04 LTS 18.04:LTS rake 12.3.1-1ubuntu0.1

Vulnerabilities 1

  • Medium 6.4
    CVE-2020-8130

    OS Command Injection in Rake

    There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.

    rake rake rake Debian Ubuntu RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2020-8130