geokit-rails Command Injection vulnerability

CRITICAL 9.8CVE-2023-26153 · GHSA-7xvc-v44j-46fh · Published 06/10/2023 · updated 17/06/2026

In short

CVE-2023-26153 is a CRITICAL (CVSS 9.8) vulnerability affecting geokit-rails, geokit-rails (geokit).
Chance of exploitation in the next 30 days (EPSS): 3.8%, higher than 90.2% of all vulnerabilities.
Fix: update to 2.5.0 or later.

Package	Affected versions	Patched versions
geokit-rails RubyGems	`< 2.5.0`	`2.5.0`
geokit-rails geokit	`< 2.5.0`	`2.5.0`

Description

Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value.

Note:

An attacker can use this vulnerability to execute commands on the host system.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2023-26153 · ADVISORY
geokit/geokit-rails commit 7ffc581 · WEB
geokit/geokit-rails commit a93dfe4 · WEB
gist.github.com/CalumHutton/b7aa1c2e71c8d4386463ac14f686901d · WEB
GitHub Advisory GHSA-7xvc-v44j-46fh · ADVISORY
geokit/geokit-rails · PACKAGE
geokit/geokit-rails · WEB
geokit/geokit-rails · WEB
rubysec/ruby-advisory-db · WEB
security.snyk.io/vuln/SNYK-RUBY-GEOKITRAILS-5920323 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

geokit-rails

RubyGems

< 2.5.0

2.5.0

geokit-rails

geokit

< 2.5.0

2.5.0

Description

Note:

An attacker can use this vulnerability to execute commands on the host system.

NVD description