{"id":"GHSA-rqp5-pg7w-832p","summary":"datagrid contains code Injection backdoor","details":"The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.","aliases":["CVE-2019-14281"],"modified":"2026-03-13T22:11:15.322049Z","published":"2019-07-31T04:21:27Z","database_specific":{"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2019-07-31T03:56:22Z","nvd_published_at":"2019-07-26T05:15:00Z","cwe_ids":["CWE-94"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14281"},{"type":"WEB","url":"https://github.com/rubygems/rubygems.org/issues/2072"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/datagrid/CVE-2019-14281.yml"},{"type":"WEB","url":"https://rubygems.org/gems/datagrid/versions"}],"affected":[{"package":{"name":"datagrid","ecosystem":"RubyGems","purl":"pkg:gem/datagrid"},"versions":["1.0.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/07/GHSA-rqp5-pg7w-832p/GHSA-rqp5-pg7w-832p.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}