{"answers":{"affected":"2 open source packages ship an affected version, including bitcoinrb.","exploited":"There is no known exploitation of GHSA-q66h-m87m-j2q6 in the wild and no public exploit code.","fix":"Upgrade bitcoinrb to 1.12.0 or later.","what":"GHSA-q66h-m87m-j2q6 is a command injection vulnerability in bitcoinrb, published on 10 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-q66h-m87m-j2q6 and fix it if it is affected.\n\nWhat it is: GHSA-q66h-m87m-j2q6 is a command injection vulnerability in bitcoinrb, published on 10 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-q66h-m87m-j2q6 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- bitcoinrb (RubyGems): affected all versions; fixed in 1.12.0\n- bitcoinrb (RubyGems): affected all versions; fixed in 1.12.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-q66h-m87m-j2q6/ (Markdown: https://insights.sbomify.com/GHSA-q66h-m87m-j2q6/index.md)","id":"GHSA-q66h-m87m-j2q6","markdown":"https://insights.sbomify.com/GHSA-q66h-m87m-j2q6/index.md","name":"GHSA-q66h-m87m-j2q6","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"no_fix_stated","impacts":["code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"Ruby Bitcoin library","requires_auth":"none","summary":"Remote attackers can execute arbitrary system commands via the experimental RPC server due to unsafe parameter handling in the Bitcoinrb Ruby library.","user_interaction":"not_required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary: Remote Code Execution\nUnsafe handling of request parameters in the RPC HTTP server results in command injection\n\n### Details\nIn lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into `command` and `args` variables. These values are then passed to `send`, which is used to call an arbitrary class method. However, there is no validation that the provided `command` value is one of the expected RPC methods. \nThis means that an attacker could supply a `command` value such as `system`, and then pass arbitrary system commands into the `args` parameter and achieve remote code execution. \n\n### PoC\n1. Start the RPC server\n2. Send a request to the RPC server as so:\n ```\ncurl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \\\n    -d '{\"method\":\"eval\",\"params\":[\"File.write(\\\"/tmp/pwned\\\",\\\"owned\\\")\"]}'\n```\n3. Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.\n### Impact\nThis vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.\n\n### Remediation                                                \n                                                                                                                                                                                                                               \n  **Mitigating Factors:**                                                                                                                                                                                                      \n  - The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.                                                                                                               \n  - The SPV-related features may be removed in future releases.                                                                                                                                                                \n                                                                                                                                                                                                                               \n  **Resolution:**                                                                                                                                                                                                              \n  - Added whitelist validation to allow only RPC methods defined in `RequestHandler`.                                                                                                                                          \n  - Fixed in version 1.12.0.","ecosystems":["RubyGems"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Bitcoinrb Vulnerable to Command injection via RPC","id":"GHSA-q66h-m87m-j2q6","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"RubyGems","product":null,"products":[],"type":"command_injection","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"RubyGems","fixed":["1.12.0"],"introduced":["0"],"last_affected":[],"package":"bitcoinrb","purl":null,"source":"GHSA-q66h-m87m-j2q6"},{"ecosystem":"RubyGems","fixed":["1.12.0"],"introduced":["0"],"last_affected":[],"package":"bitcoinrb","purl":"pkg:gem/bitcoinrb","source":"GHSA-q66h-m87m-j2q6"}],"products":null,"published":"2026-02-10","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Remote attackers can execute arbitrary system commands via the experimental RPC server due to unsafe parameter handling in the Bitcoinrb Ruby library.","url":"https://insights.sbomify.com/GHSA-q66h-m87m-j2q6/"}