CVE-2013-0285: The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly rest...

Security readout for executives and security teams

Some Ruby applications using old nori gem versions could turn attacker-controlled XML text into unsafe Ruby objects. The CVE states this may allow arbitrary code execution or resource-exhaustion denial of service. The source bundle identifies fixed nori releases for affected branches. Exposure is most likely in Ruby applications that include vulnerable nori versions and process attacker-controlled XML through Rails Action Pack-related type conversion paths. The bundle does not provide normalized vendor, CPE, or package-manager inventory data. Treat as high priority for legacy Ruby systems that accept XML. The business concern is outage or server compromise, but urgency depends on whether vulnerable nori versions remain deployed and reachable by untrusted input. Mitigation focus: Upgrade nori to 2.0.2, 1.1.4, 1.0.3, or later as appropriate.; Review vendor and framework guidance for related Action Pack XML parsing changes.; Remove or restrict unsafe XML type conversion where business logic allows..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.