Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-21289

26
FAUCET Score

CVE-2021-21289 is a command injection vulnerability affecting Mechanize versions 2.0.0 through 2.7.6, an open-source Ruby library for automated web interaction. This flaw allows for OS command injection if untrusted input is used as a local filename and passed to specific methods like Mechanize::CookieJar#load or Mechanize#download. With a CVSS score of 8.3 (HIGH), exploitation requires user interaction and high attack complexity, but can lead to complete compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.0, < 2.7.7CPE matchmatch criteria
cpe:2.3:a:mechanize_project:mechanize:*:*:*:*:*:ruby:*:*
32CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
33CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
9.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.4HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
4.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
3.51%
Probability of exploitation in next 30 days
EPSS Percentile
88.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0351 is in the 57th percentile among its peer group of 1,572 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.4 Bluesky, 0.2 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.6 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

github_advisorypatch availablevia nvd_reference
View patch
rubygemspatch availablevia ghsa
Product: mechanizeFixed in: 2.7.7
redhatend of lifevia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: mechanize

Vendor Advisories (2)

rubygemsGHSA-qrqm-fpv6-6r8ghigh

Command Injection Vulnerability in Mechanize

Feb 2, 2021
redhatCVE-2021-21289Moderate

rubygem-mechanize: OS command injection via untrusted input to Ruby's Kernel.open method

Feb 1, 2021

References

github.com / sparklemotion/mechanize/commit/66a6a1bfa653a5f13274a396a5e5441238656aa0
PatchThird Party Advisory
github.com / sparklemotion/mechanize/releases/tag/v2.7.7
Release NotesThird Party Advisory
github.com / sparklemotion/mechanize/security/advisories/GHSA-qrqm-fpv6-6r8g
Third Party Advisory
lists.debian.org / debian-lts-announce/2021/02/msg00021.html
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/LBVVJUL4P4KCJH4IQTHFZ4ATXY7XXZPV
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/YNFZ7ROYS6V4J5L5PRAJUG2AWC7VXR2V
rubygems.org / gems/mechanize
ProductThird Party Advisory
security.gentoo.org / glsa/202107-17
Third Party Advisory