Skip to content
OpenAdvisories

Package · RubyGems

arr-pm

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.0
    CVE-2022-39224

    Arbitrary shell execution when extracting or listing files contained in a malicious rpm.

    Arr-pm is an RPM reader/writer library written in Ruby. Versions prior to 0.0.12 are subject to OS command injection resulting in shell execution if the RPM contains a malicious "payload compressor" field. This vulnerability impacts the `extract` and `files` …

    jordansissel ruby-arr-pm arr-pm RubyGems