rest-client Gem Contains Malicious Code

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

• CVE-2019-15224: 3.55% estimated exploitation activity in the next 30 days; percentile 89.32 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x. Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory. These include cronparser, coinbase, blockchainwallet, awesome-bot, doge-coin, capistrano-colors, bitcoinvanity, litacoin, coming-soon, and omniauthamazon.

Published by the source

20 Aug 2019, 14:29 UTC

Last modified by the source

28 Aug 2023, 21:39 UTC

Source last checked

26 Oct 2026, 15:47 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-333g-rpr4-7hxq

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2019-15224

Advisory: rest-client Gem Contains Malicious Code
IDs: CVE-2019-15224, GHSA-333g-rpr4-7hxq
Record: https://patchnext.com/advisories/cve-2019-15224 (revision 1, source checked 26 Oct 2026, 15:47 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Partial vendor fix; fixed versions by package: rest-client 1.7.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- RubyGems coming-soon: affected every version
- RubyGems omniauth_amazon: affected every version
- RubyGems blockchain_wallet: affected every version
- RubyGems capistrano-colors: affected every version
- RubyGems coin_base: affected every version
- RubyGems bitcoin_vanity: affected every version
- RubyGems cron_parser: affected >= 1.0.13, <= 1.0.14; >= 0.1.4, <= 0.1.4
- RubyGems awesome-bot: affected every version
- RubyGems rest-client: affected >= 1.6.10, <= 1.6.13; fixed in 1.7.0
- RubyGems doge-coin: affected every version

## Suggested inspection (read-only)
- RubyGems coming-soon: check the installed version with your package manager.
- RubyGems omniauth_amazon: check the installed version with your package manager.
- RubyGems blockchain_wallet: check the installed version with your package manager.
- RubyGems capistrano-colors: check the installed version with your package manager.
- RubyGems coin_base: check the installed version with your package manager.
- RubyGems bitcoin_vanity: check the installed version with your package manager.
- RubyGems cron_parser: check the installed version with your package manager.
- RubyGems awesome-bot: check the installed version with your package manager.
- RubyGems rest-client: check the installed version with your package manager.
- RubyGems doge-coin: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on coming-soon, omniauth_amazon, blockchain_wallet, capistrano-colors, coin_base, bitcoin_vanity, cron_parser, awesome-bot, rest-client, doge-coin.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-333g-rpr4-7hxq (GitHub-reviewed advisory GHSA-333g-rpr4-7hxq lists affected ranges: RubyGems rest-client >=1.6.10 =1.0.13 =0.1.4 =0; RubyGems blockchain_wallet >=0; RubyGems awesome-bot >=0; RubyGems doge-coin >=0; RubyGems capistrano-colors >=0; RubyGems bitcoin_vanity >=0; RubyGems coming-soon >=0; RubyGems omniauth_amazon >=0)

Commands are suggestions: review each one before running it.