CVE-2025-53623

Deeper analysis

The Job Iteration API, an extension for ActiveJob that enables interruptible and resumable jobs, contains an arbitrary code execution vulnerability in the CsvEnumerator class in all versions prior to 1.11.0. The flaw, tracked as CVE-2025-53623 and assigned CWE-78, stems from insufficient validation of input passed to methods such as count_of_rows_in_file, allowing OS command injection when untrusted CSV filenames are processed. The issue received a CVSS 4.0 score of 8.1 reflecting network-accessible exploitation with high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can supply a malicious filename or path to the CsvEnumerator class and execute arbitrary commands on the host running the application, potentially resulting in full system compromise, data exfiltration, or unauthorized access. Exploitation requires the vulnerable code path to be reached with attacker-controlled input, which can occur in any application using the library without additional sanitization.

The official advisory and patch notes recommend upgrading to version 1.11.0 or later, where the issue is resolved. In the absence of an upgrade, users are advised to avoid passing untrusted input to CsvEnumerator entirely and to sanitize and validate all file paths before use.

The EPSS score has remained flat at 0.0123 with no material increase since disclosure.