smalruby and smalruby-editor vulnerable to OS Command Injection

CRITICAL 9.8CVE-2017-2096 · GHSA-f489-655r-x6gr · Published 28/04/2017 · updated 17/06/2026

In short

CVE-2017-2096 is a CRITICAL (CVSS 9.8) vulnerability affecting smalruby, smalruby-editor, smalruby-editor (smalruby).
Chance of exploitation in the next 30 days (EPSS): 6.2%, higher than 93.5% of all vulnerabilities.
Fix: update to 0.1.11, 0.4.1 or later.

smalruby-editor prior to 0.4.1 and smalruby prior to 0.1.11 allows remote attackers to execute arbitrary OS commands via unspecified vectors.

NVD description

smalruby-editor v0.4.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.