Description
converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | md2pdf | <= 0.0.1 | — | GHSA-99ch-8mvp-g7m5 |
References
- http://vapid.dhs.org/advisories/md2pdf-remote-exec.html
- 92290 vdb-entry
- md2pdf-cve20131948-command-exec(83416) vdb-entry
- 59061 vdb-entry