Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-3xkv-ckqz-r3dx
Vulnerability ID VCID-3xkv-ckqz-r3dx
Aliases CVE-2012-2140
GHSA-rp63-jfmw-532w
OSV-81632
Summary Improper Input Validation The Mail gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-20 Improper Input Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
System Score Found at
generic_textual HIGH http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html
generic_textual HIGH http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html
generic_textual HIGH http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
epss 0.03667 https://api.first.org/data/v1/epss?cve=CVE-2012-2140
generic_textual HIGH https://bugzilla.novell.com/show_bug.cgi?id=759092
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=816352
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-rp63-jfmw-532w
generic_textual HIGH https://github.com/mikel/mail
generic_textual HIGH https://github.com/mikel/mail/blob/9beb079c70d236a5ad2e1ba95b2c977e55deb7af/CHANGELOG.rdoc
generic_textual HIGH https://github.com/mikel/mail/commit/39b590ddb08f90ddbe445837359a2c8843e533d0
generic_textual HIGH https://github.com/mikel/mail/commit/ac56f03bdfc30b379aeecd4ff317d08fdaa328c2
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2012-2140
generic_textual HIGH http://www.openwall.com/lists/oss-security/2012/04/25/8
generic_textual HIGH http://www.openwall.com/lists/oss-security/2012/04/26/1
Reference id Reference type URL
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-2140.json
https://api.first.org/data/v1/epss?cve=CVE-2012-2140
https://bugzilla.novell.com/show_bug.cgi?id=759092
https://bugzilla.redhat.com/show_bug.cgi?id=816352
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2140
http://secunia.com/advisories/48970
https://github.com/mikel/mail
https://github.com/mikel/mail/blob/9beb079c70d236a5ad2e1ba95b2c977e55deb7af/CHANGELOG.rdoc
https://github.com/mikel/mail/commit/39b590ddb08f90ddbe445837359a2c8843e533d0
https://github.com/mikel/mail/commit/ac56f03bdfc30b379aeecd4ff317d08fdaa328c2
http://www.openwall.com/lists/oss-security/2012/04/25/8
http://www.openwall.com/lists/oss-security/2012/04/26/1
CVE-2012-2140 https://nvd.nist.gov/vuln/detail/CVE-2012-2140
GHSA-rp63-jfmw-532w https://github.com/advisories/GHSA-rp63-jfmw-532w
RHSA-2012:1542 https://access.redhat.com/errata/RHSA-2012:1542
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.87844
EPSS Score 0.03667
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:46:47.060088+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/mail/CVE-2012-2140.yml 38.0.0