CVE-2011-10019 Spreecommerce < 0.60.2 Search Parameter RCE

What is CVE-2011-10019?

CVE-2011-10019 is a critical code injection vulnerability in Spreecommerce, published on 13 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.

Weakness: CWE-94, CWE-1321

Which versions are affected by CVE-2011-10019?

2 open source packages ship an affected version, including spree. It affects 1 product.

Products include Spreecommerce Spree.

How do I fix CVE-2011-10019?

Upgrade spree to 0.60.2 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2011-10019 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-10019 exists.

Public exploit code: 1 Metasploit module.

Other vulnerabilities in Spreecommerce

• CVE-2011-10026 Spreecommerce < 0.50.x API RCE Critical 9.3
• CVE-2026-25757 Unauthenticated Spree Commerce users can view completed guest orders by Order ID High 7.7
• CVE-2026-25758 Spree allows unauthenticated users can access all guest addresses High 7.7
• CVE-2020-26223 Authorization bypass in Spree High 7.7
• CVE-2026-22589 Spree API has Unauthenticated IDOR - Guest Address High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-97vm-c39p-jr86.