GitHub Advisoryadvisory · RubyGems

GHSA-qpqw-mc85-qvm9 OS Command Injection in awesome spawn

CRITICAL Published 2022-07-01 Modified 2023-01-24 Official page ↗
Aliases
CVE-2014-0156
Ecosystem
RubyGems
Packages
awesome_spawn
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2022-07-21

Affected packages

• RubyGems awesome_spawn: < 1.2.0 → fixed in 1.2.0

Description

Awesome spawn prior to version 1.2.0 contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command.

Related

Alias · CVE (1)

  • CVE-2014-0156 Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References