Skip to content
OpenAdvisories

Package · RubyGems

mini_magick

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.8
    CVE-2019-13574 Public exploit

    OS Command Injection in MiniMagick

    In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.

    mini_magick ruby-mini-magick ruby-mini-magick Debian Ubuntu RubyGems
  • High —
    CVE-2013-2616

    MiniMagick Gem for Ruby URI Handling Arbitrary Command Injection

    lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.

    mini_magick RubyGems