Arbitrary Code Execution in Rdoc
High severity
GitHub Reviewed
Published
Sep 1, 2021
to the GitHub Advisory Database
•
Updated Jan 5, 2024
Package
Affected versions
>= 3.11, < 6.1.2.1
>= 6.2.0, < 6.2.1.1
>= 6.3.0, < 6.3.1
Patched versions
6.1.2.1
6.2.1.1
6.3.1
Description
Published by the National Vulnerability Database
Jul 30, 2021
Reviewed
Aug 2, 2021
Published to the GitHub Advisory Database
Sep 1, 2021
Last updated
Jan 5, 2024
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
References