BibTeX-Ruby vulnerable to OS command injection

CRITICO 9.8CVE-2019-10780 · GHSA-c5r5-7pfh-6qg6 · SNYK-RUBY-BIBTEXRUBY-542602 · Published 22/01/2020 · updated 17/06/2026

In breve

CVE-2019-10780 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda bibtex-ruby, bibtex-ruby (bibtex-ruby project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.8%, superiore al 86.6% delle vulnerabilità.
Correzione: aggiornare a 5.1.0 o successiva.

Package	Affected versions	Patched versions
bibtex-ruby RubyGems	`< 5.1.0`	`5.1.0`
bibtex-ruby bibtex-ruby_project	`< 5.1.0`	`5.1.0`

Description

BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.

NVD description

BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.

References

nvd.nist.gov/vuln/detail/CVE-2019-10780 · ADVISORY
inukshuk/bibtex-ruby commit 14406f4 · WEB
GitHub Advisory GHSA-c5r5-7pfh-6qg6 · ADVISORY
inukshuk/bibtex-ruby · PACKAGE
rubysec/ruby-advisory-db · WEB
snyk.io/vuln/SNYK-RUBY-BIBTEXRUBY-542602 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free