GitHub Advisoryadvisory · RubyGems

GHSA-4fvg-pwv7-v54g Karteek Docsplit vulnerable to OS Command Injection

HIGH Published 2022-05-17 Modified 2023-01-26 Official page ↗
Aliases
CVE-2013-1933
Ecosystem
RubyGems
Packages
karteek-docsplit
Severity
High
Weaknesses
CWE-78
Reviewed
2023-01-26

Affected packages

• RubyGems karteek-docsplit: <= 0.5.4 (no fix yet)

Description

The `extract_from_ocr` function in `lib/docsplit/text_extractor.rb` in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.

Related

Alias · CVE (1)

  • CVE-2013-1933 The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References