CVE-2013-0175 Improper Input Validation in multi_xml
Remote attackers can execute arbitrary code or cause denial of service via unsafe XML deserialization in the multi_xml Ruby gem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-0175?
CVE-2013-0175 is a high-severity unsafe deserialization vulnerability in n/a, published on 25 Apr 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Weakness: CWE-20
Which versions are affected by CVE-2013-0175?
2 open source packages ship an affected version, including multi_xml. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
multi_xml RubyGems | All versions | 0.5.2 |
multi_xml RubyGems | All versions | 0.5.2 |
Linux distribution packages (4)
ruby3.2-rubygem-multi_xml openSUSE:Tumbleweed | All versions | 0.6.0-1.23 |
rubygem-multi_xml openSUSE:Tumbleweed | All versions | 0.6.0-1.27 |
rubygem-multi_xml openSUSE:Tumbleweed | All versions | 0.6.0-1.29 |
rubygem-multi_xml openSUSE:Tumbleweed | All versions | 0.6.0-1.31 |
Products include Erik Michaels-Ober Multi Xml, Grape Project Grape.
How do I fix CVE-2013-0175?
Upgrade multi_xml to 0.5.2 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2013-0175 being exploited?
There is no known exploitation of CVE-2013-0175 in the wild and no public exploit code.
Sources
Also known as GHSA-pchc-949f-53m5, openSUSE-SU-2024:11339-1, openSUSE-SU-2024:13164-1, openSUSE-SU-2024:14173-1, openSUSE-SU-2025:15122-1, openSUSE-SU-2026:10355-1.