CVE-2011-10019 is a critical (CVSS 9.8) remote command execution flaw in Spree (spreecommerce) before 0.60.2. The search feature passes a user-supplied parameter to Ruby's send method, so an unauthenticated visitor can make the server run shell commands. Upgrade to 0.60.2 or later.
What's affected
Spree (spreecommerce) versions prior to 0.60.2. The record says the problem is in the search functionality, where the search[send][] parameter is dynamically invoked using Ruby's send method. VulnCheck's advisory gives the same range, Spreecommerce before 0.60.2.
This is an old release line. Few teams run Spree 0.x today, but forks, long-lived vendor copies and abandoned storefronts exist. If you maintain one, treat it as exposed until proven otherwise. A related issue in the API search, CVE-2011-10026, affects earlier releases. Because the flaw is in a gem, the version in your Gemfile.lock decides it. Check every environment, since a staging branch can lag production by years.
How to check if you're exposed
For a Ruby application, check which Spree version your bundle resolves:
bundle list | grep -i spree
grep -i spree Gemfile Gemfile.lock
If the gem is below 0.60.2, the application is in scope. If you vendored a copy of Spree into your tree, check the version file in the vendored code rather than relying on the Gemfile.
Then look at the application code you own. Search for places where request parameters reach the send, public_send or instance_eval methods, since that is the pattern behind this CVE.
grep -rn "\.send(" app lib | head -50
Each hit that takes user input needs a review.
What to do now
- Identify every Spree install and its version, including forks and vendored copies.
- Upgrade to 0.60.2 or later. If you are far behind, plan a staged upgrade to a currently maintained release instead of a minimal bump.
- Review custom code for dynamic method calls on user-supplied names, and replace them with an allowlist of permitted search fields.
- Check web and application logs for unusual search requests around your exposure period.
- Rotate secrets that the application server can read, such as database credentials, if you suspect exposure.
Why it matters
The record lists CWE-94 (Code Injection) and CWE-1321 (Prototype Pollution) for this CVE. The practical cause is dynamic dispatch on untrusted input. Ruby's send method calls whatever method name you hand it. When a search form lets the visitor choose that name, the visitor chooses what the server runs.
The fix pattern is old and simple: never pass request data as a method name. Map user choices to a fixed set of allowed operations, and reject everything else. This applies to any language with reflection or dynamic calls.
The record does not mark this CVE as CISA KEV. The references include public exploit material, and the vendor published its own advisory in October 2011, so the issue is long known.
Try it yourself
Not every finding is equally urgent. This demo shows how to weigh exploitability before you decide what to fix first.
Click through it at your own pace, or open it full screen.
Quick check
Which Spree version fixes this?
The record says versions prior to 0.60.2 are affected, so 0.60.2 or later. Check the Spree advisory for anything newer.
Why is send dangerous here?
Ruby send calls any method by name. If a visitor controls the name, they control which method the server calls.
Sources
Last reviewed: 19 October 2026.
