Description
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby3.2-rubygem-multi_xml | 0.6.0-1.23 | openSUSE-SU-2024:13164-1 |
| openSUSE Tumbleweed | rubygem-multi_xml | 0.6.0-1.27 | openSUSE-SU-2026:10355-1, openSUSE-SU-2025:15122-1, openSUSE-SU-2024:14173-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | multi_xml | < 0.5.2 | 0.5.2 | GHSA-pchc-949f-53m5 |
Advisories 4
- openSUSE-SU-2026:10355-1 ruby4.0-rubygem-multi_xml-0.6.0-1.31 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
- openSUSE-SU-2024:14173-1 ruby3.3-rubygem-multi_xml-0.6.0-1.27 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13164-1 ruby3.2-rubygem-multi_xml-0.6.0-1.23 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15122-1 ruby3.4-rubygem-multi_xml-0.6.0-1.29 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/sferik/multi_xml/pull/34
- https://gist.github.com/nate/d7f6d9f4925f413621aa
- [oss-security] 20130111 Re: CVE request for multi_xml ruby gem (has same problem as CVE-2013-0156) mailing-list
- https://groups.google.com/forum/?fromgroups=#%21topic/ruby-grape/fthDkMgIOa0
- https://news.ycombinator.com/item?id=5040457