Disclosure summary
Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."
Source-reported weakness categories
CWE-78
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
Microsoft Security Updates (CVRF) · 2025-Jul
Open original source · Updated Sep 04, 2025
Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."
Maximum of vendor-reported product scores; products and fixed builds are associations, not a universal affected-version statement.
Microsoft maximum product score: 2.8
| Vendor | Product / association | Version / bounds |
|---|---|---|
| Microsoft update guide | cbl2 rubygem-thor 1.2.1-2 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 rubygem-thor 1.2.1-3 on CBL Mariner 2.0 | (MSRC status code 3) |
Vendor remediation references
- CBL-Mariner Releases · build 1.2.1-3 · product IDs 20344-17086, 20395-17086
- Vendor guidance · product IDs 20344-17086, 20395-17086
Original records & references
- NIST NVD record
- CVE Program record
- msrc.microsoft.com — Vendor advisory
PUBLISHED 2025-09-04T00:06:48-04:00
MODIFIED 2025-09-04T00:06:48-04:00
INGESTED 2026-10-08T12:45:47-04:00