Skip to content
OpenAdvisories
High · 8.4 CVE-2026-67986 EUVD-2026-58030GHSA-4fc2-r6x5-wm8p

amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArr…

Published Aug 13, 2026 · Updated Aug 13, 2026 · Assigned by mitre

Description

amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ruby-amazing-print No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 ruby-amazing-print No fix yet —

References