| Package | Affected versions | Patched versions |
|---|---|---|
| graalvm | = 19.3.0.2 | |
| ruby | ≥ 2.4.0, ≤ 2.4.7≥ 2.5.0, ≤ 2.5.6≥ 2.6.0, ≤ 2.6.4 |
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free