CVE-2022-24803

Command Injection vulnerability in asciidoctor-include-ext

require 'asciidoctor/include_ext'

class Asciidoctor::IncludeExt::IncludeProcessor
  # Overrides superclass private method to mitigate Command Injection
  # vulnerability in asciidoctor-include-ext <0.4.0.
  def target_uri?(target)
    target.downcase.start_with?('http://', 'https://') \
      && URI.parse(target).is_a?(URI::HTTP)
  rescue URI::InvalidURIError
    false
  end
end

Applications using Asciidoctor (Ruby) with asciidoctor-include-ext (prior to version 0.4.0), which render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when allow-uri-read is disabled! (EDIT: it’s not)

Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.

CVE-2022-24803 has a CVSS score of 10.0 (Critical). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.4.0); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

The vulnerability has been fixed in commit c7ea001 (and further improved in cbaccf3), which is included in version 0.4.0.

1. What is CVE-2022-24803? CVE-2022-24803 is a critical-severity OS command injection vulnerability in asciidoctor-include-ext (rubygems), affecting versions < 0.4.0. It is fixed in 0.4.0. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
2. How severe is CVE-2022-24803? CVE-2022-24803 has a CVSS score of 10.0 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of asciidoctor-include-ext are affected by CVE-2022-24803? asciidoctor-include-ext (rubygems) versions < 0.4.0 is affected.
4. Is there a fix for CVE-2022-24803? Yes. CVE-2022-24803 is fixed in 0.4.0. Upgrade to this version or later.
5. Is CVE-2022-24803 exploitable, and should I be worried? Whether CVE-2022-24803 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2022-24803 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2022-24803? Upgrade asciidoctor-include-ext to 0.4.0 or later.