| Package | Affected versions | Patched versions |
|---|---|---|
| mini_magick | < 4.9.4 | 4.9.4 |
| minimagick | < 4.9.4 | 4.9.4 |
In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a | character followed by a command.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free