CVE-2019-13574: Debian Linux

High severity, CVSS 7.8. EPSS: 7.6% chance of exploitation in the next 30 days.

In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Minimagick Project Minimagick: before 4.9.4 (fixed in 4.9.4)

Published 2019-07-12. Last modified 2026-06-17.