Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ GHSA-q66h-m87m-j2q6 — bitcoinrb

🟢 CVSS 2.0 — Low ✅ No Known Exploit CWE-77 OSV
2.0
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Bitcoinrb Vulnerable to Command injection via RPC

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods.

This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

1. Start the RPC server

2. Send a request to the RPC server as so:

```

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \

-d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

```

3. Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

  • The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
  • The SPV-related features may be removed in future releases.

Resolution:

  • Added whitelist validation to allow only RPC methods defined in RequestHandler.
  • Fixed in version 1.12.0.

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. Rated impact: confidentiality none, integrity low, availability none.

Weakness class

GHSA-q66h-m87m-j2q6 is classified as CWE-77: Command Injection. User input is placed into a command that the system interprets, allowing extra commands to be appended to the intended one.

Affected software

GHSA-q66h-m87m-j2q6 is recorded against 1 package.

  • bitcoinrb (fixed in 1.12.0)

Timeline and source

Published on 10 February 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
github.com (Web)
github.com (Package)
github.com (Web)

Details

Severity LOW
CVSS Score 2.0
CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CWE CWE-77
Public Exploit ✅ No
Source OSV
Published 2026-02-10
Updated 2026-08-20
Modified 2026-02-10
Fix URL N/A

Affected Packages

Software From version Fixed in
bitcoinrb — 1.12.0

Free Vulnerability Check

Is your site affected by GHSA-q66h-m87m-j2q6?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against GHSA-q66h-m87m-j2q6 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.