CVE-2024-27281 RDoc RCE vulnerability with .rdoc_options
Attackers can achieve remote code execution by exploiting unsafe YAML deserialization in RDoc configuration files or documentation caches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-27281?
CVE-2024-27281 is a medium-severity unsafe deserialization vulnerability in n/a, published on 8 May 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. (When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed version is rdoc 6.5.1.1.
Weakness: CWE-502
Which versions are affected by CVE-2024-27281?
8 open source packages ship an affected version, including rdoc.
| Package | Affected | Fixed in |
|---|---|---|
rdoc RubyGems | From 6.3.3 | 6.3.4.1 |
rdoc RubyGems | From 6.3.3 | 6.3.4.1 |
rdoc RubyGems | From 6.4.0 | 6.4.1.1 |
rdoc RubyGems | From 6.4.0 | 6.4.1.1 |
rdoc RubyGems | From 6.5.0 | 6.5.1.1 |
rdoc RubyGems | From 6.5.0 | 6.5.1.1 |
2 more packages
rdoc RubyGems | From 6.6.0 | 6.6.3.1 |
rdoc RubyGems | From 6.6.0 | 6.6.3.1 |
How do I fix CVE-2024-27281?
Upgrade rdoc to a fixed version for your release line: 6.3.4.1, 6.4.1.1, 6.5.1.1 or 6.6.3.1.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-27281 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27281 exists.
Sources
Also known as ALPINE-CVE-2024-27281, AZL-40523, AZL-40675, BELL-CVE-2024-27281, CLEANSTART-2026-GN52279, CLSA-2025-1753375058 and 4 more.