GitHub Advisoryadvisory · RubyGems

GHSA-jppv-gw3r-w3q8 OS Command Injection in Rake

MEDIUM Published 2020-02-28 Modified 2023-08-29 Official page ↗
Aliases
CVE-2020-8130
Ecosystem
RubyGems
Packages
rake
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2020-02-25

Affected packages

• RubyGems rake: < 12.3.3 → fixed in 12.3.3

Description

There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in `Rake::FileList` when supplying a filename that begins with the pipe character `|`.

Related

Alias · CVE (1)

  • CVE-2020-8130 There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References