md2pdf allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename

CRITICO 10.0CVE-2013-1948 · GHSA-99ch-8mvp-g7m5 · Published 25/04/2013 · updated 16/06/2026

In breve

CVE-2013-1948 è una vulnerabilità CRITICO (CVSS 10.0) che riguarda md2pdf, md2pdf (rob westgeest).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.2%, superiore al 82.3% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
md2pdf RubyGems	`≤ 0.0.1`	No fix yet
md2pdf rob_westgeest	`= 0.0.1`	No fix yet

Description

converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.

NVD description

converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.

References

nvd.nist.gov/vuln/detail/CVE-2013-1948 · ADVISORY
exchange.xforce.ibmcloud.com/vulnerabilities/83416 · WEB
rubysec/ruby-advisory-db · WEB
rwestgeest/md2pdf · PACKAGE
web.archive.org/web/20130503194109/http://www.securityfocus.com/bid/59061 · WEB
vapid.dhs.org/advisories/md2pdf-remote-exec.html · WEB
osvdb.org/92290
securityfocus.com/bid/59061

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free