bitcoinrb

Version	Released
`1.14.0` minor	Aug 09, 2026
`1.13.0` minor	Jul 29, 2026
`1.12.1` patch	Jul 27, 2026
`1.12.0` minor	Feb 07, 2026
`1.11.0` minor 1 CVE	Dec 15, 2025
`1.10.0` minor 1 CVE	Nov 09, 2025
`1.9.1` patch 1 CVE	Aug 05, 2025
`1.9.0` minor 1 CVE	Aug 04, 2025
`1.8.2` patch 1 CVE	May 20, 2025
`1.8.1` patch 1 CVE	Mar 18, 2025
`1.8.0` minor 1 CVE	Feb 03, 2025
`1.7.0` minor 1 CVE	Aug 17, 2024
`1.6.0` minor 1 CVE	Jul 09, 2024
`1.5.0` minor 1 CVE	Mar 14, 2024
`1.4.0` minor 1 CVE	Dec 19, 2023
`1.3.0` minor 1 CVE	Apr 07, 2023
`1.2.1` patch 1 CVE	Oct 28, 2022
`1.2.0` minor 1 CVE	Oct 24, 2022
`1.1.1` patch 1 CVE	May 22, 2022
`1.1.0` minor 1 CVE	May 21, 2022
`1.0.0` major 1 CVE	Nov 16, 2021
`0.9.0` minor 1 CVE	Nov 12, 2021
`0.8.0` minor 1 CVE	Jun 29, 2021
`0.7.0` minor 1 CVE	Feb 19, 2021
`0.6.0` minor 1 CVE	Jan 20, 2021
`0.5.0` minor 1 CVE	Aug 19, 2020
`0.4.0` minor 1 CVE	Dec 27, 2019
`0.3.2` patch 1 CVE	Dec 14, 2019
`0.3.1` patch 1 CVE	Dec 02, 2019
`0.3.0` minor 1 CVE	Nov 30, 2019
`0.2.9` patch 1 CVE	Sep 02, 2019
`0.2.8` patch 1 CVE	Jun 04, 2019
`0.2.7` patch 1 CVE	May 01, 2019
`0.2.6` patch 1 CVE	Apr 10, 2019
`0.2.5` patch 1 CVE	Jan 14, 2019
`0.2.4` patch 1 CVE	Dec 13, 2018
`0.2.2` patch 1 CVE	Sep 29, 2018
`0.2.1` patch 1 CVE	Aug 02, 2018
`0.2.0` minor 1 CVE	Jul 30, 2018
`0.1.9` patch 1 CVE	Jun 22, 2018
`0.1.8` patch 1 CVE	Jun 08, 2018
`0.1.7` patch 1 CVE	Mar 01, 2018
`0.1.6` patch 1 CVE	Feb 18, 2018
`0.1.5` patch 1 CVE	Dec 13, 2017
`0.1.4` patch 1 CVE	Dec 02, 2017
`0.1.3` patch 1 CVE	Oct 03, 2017
`0.1.2` patch 1 CVE	Oct 02, 2017
`0.1.1` minor 1 CVE	Sep 08, 2017
`0.0.1` initial 1 CVE	Aug 25, 2017

1.14.0 minor

Aug 09, 2026

1.13.0 minor

Jul 29, 2026

1.12.1 patch

Jul 27, 2026

1.12.0 minor

Feb 07, 2026

1.11.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Dec 15, 2025

1.10.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Nov 09, 2025

1.9.1 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Aug 05, 2025

1.9.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Aug 04, 2025

1.8.2 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

May 20, 2025

1.8.1 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Mar 18, 2025

1.8.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Feb 03, 2025

1.7.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Aug 17, 2024

1.6.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Jul 09, 2024

1.5.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Mar 14, 2024

1.4.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Dec 19, 2023

1.3.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Apr 07, 2023

1.2.1 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Oct 28, 2022

1.2.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Oct 24, 2022

1.1.1 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

May 22, 2022

1.1.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

May 21, 2022

1.0.0 major

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Nov 16, 2021

0.9.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Nov 12, 2021

0.8.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Jun 29, 2021

0.7.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Feb 19, 2021

0.6.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Jan 20, 2021

0.5.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Aug 19, 2020

0.4.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Dec 27, 2019

0.3.2 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Dec 14, 2019

0.3.1 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Dec 02, 2019

0.3.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Nov 30, 2019

0.2.9 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Sep 02, 2019

0.2.8 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Jun 04, 2019

0.2.7 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

May 01, 2019

0.2.6 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Apr 10, 2019

0.2.5 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Jan 14, 2019

0.2.4 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Dec 13, 2018

0.2.2 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Sep 29, 2018

0.2.1 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Aug 02, 2018

0.2.0 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Jul 30, 2018

0.1.9 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Jun 22, 2018

0.1.8 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Jun 08, 2018

0.1.7 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Mar 01, 2018

0.1.6 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Feb 18, 2018

0.1.5 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Dec 13, 2017

0.1.4 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Dec 02, 2017

0.1.3 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Oct 03, 2017

0.1.2 patch

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Oct 02, 2017

0.1.1 minor

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Sep 08, 2017

0.0.1 initial

1 CVE

GHSA-q66h-m87m-j2q6 Feb 10, 2026

Bitcoinrb Vulnerable to Command injection via RPC

Low

Local Low None None

Summary: Remote Code Execution

Unsafe handling of request parameters in the RPC HTTP server results in command injection

Details

In lib/bitcoin/rpc/http_server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is used to call an arbitrary class method. However, there is no validation that the provided command value is one of the expected RPC methods. This means that an attacker could supply a command value such as system, and then pass arbitrary system commands into the args parameter and achieve remote code execution.

PoC

Start the RPC server
Send a request to the RPC server as so:

curl -X POST http://127.0.0.1:18443 -H 'Content-Type: application/json' \
   -d '{"method":"eval","params":["File.write(\"/tmp/pwned\",\"owned\")"]}'

Check the /tmp folder on the machine where the RPC server is being run. If a folder /pwned now exists, the vulnerability is confirmed.

Impact

This vulnerability would impact anyone running the RPC server. The impact is higher for those who are running it publicly exposed to the internet.

Remediation

Mitigating Factors:

The RPC server is part of the experimental SPV node feature, which is not documented and has very few users.
The SPV-related features may be removed in future releases.

Resolution:

Added whitelist validation to allow only RPC methods defined in RequestHandler.
Fixed in version 1.12.0.

Affected versions


          0.0.1


          0.1.1


          0.1.2


          0.1.3


          0.1.4


          0.1.5


          0.1.6


          0.1.7


          0.1.8


          0.1.9


          0.2.0


          0.2.1

+ 33 more


            0.2.2


            0.2.4


            0.2.5


            0.2.6


            0.2.7


            0.2.8


            0.2.9


            0.3.0


            0.3.1


            0.3.2


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            1.0.0


            1.1.0


            1.1.1


            1.10.0


            1.11.0


            1.2.0


            1.2.1


            1.3.0


            1.4.0


            1.5.0


            1.6.0


            1.7.0


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1

Fixed in


          1.12.0

References

Updated Feb 10, 2026 · Source: OSV.dev

Aug 25, 2017

Activity

Reach

Details