CVE-2025-54314 Command injection in Thor
An unsafe shell command construction in the Thor library could allow code execution, though the vendor disputes exploitability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54314?
CVE-2025-54314 is a low-severity command injection vulnerability in rubyonrails Thor, published on 20 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."
Weakness: CWE-78
Which versions are affected by CVE-2025-54314?
Linux distribution packages (2)
rubygem-thor openSUSE:Tumbleweed | All versions | 1.4.0-1.1 |
rubygem-thor openSUSE:Tumbleweed | All versions | 1.4.0-1.3 |
How do I fix CVE-2025-54314?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-54314 being exploited?
There is no known exploitation of CVE-2025-54314 in the wild and no public exploit code.
Sources
Also known as AZL-65613, AZL-65631, UBUNTU-CVE-2025-54314, openSUSE-SU-2025:15382-1, openSUSE-SU-2026:10366-1.