Skip to content
OpenAdvisories

Package · Debian

ruby-mini-magick

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.8
    CVE-2019-13574 Public exploit

    OS Command Injection in MiniMagick

    In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.

    mini_magick ruby-mini-magick ruby-mini-magick Debian Ubuntu RubyGems