md2pdf allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename

KRITISCH 10.0CVE-2013-1948 · GHSA-99ch-8mvp-g7m5 · Published 25/04/2013 · updated 16/06/2026

Kurz gesagt

CVE-2013-1948 ist eine Schwachstelle (KRITISCH (CVSS 10.0)) in md2pdf, md2pdf (rob westgeest).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.2%, höher als bei 82.3% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
md2pdf RubyGems	`≤ 0.0.1`	No fix yet
md2pdf rob_westgeest	`= 0.0.1`	No fix yet

Description

converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.

NVD description

converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.

References

nvd.nist.gov/vuln/detail/CVE-2013-1948 · ADVISORY
exchange.xforce.ibmcloud.com/vulnerabilities/83416 · WEB
rubysec/ruby-advisory-db · WEB
rwestgeest/md2pdf · PACKAGE
web.archive.org/web/20130503194109/http://www.securityfocus.com/bid/59061 · WEB
vapid.dhs.org/advisories/md2pdf-remote-exec.html · WEB
osvdb.org/92290
securityfocus.com/bid/59061

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free