GHSA-5ww9-9qp2-x524

Improper handling of double quotes in file name in Diffy in Windows environment

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-33127

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	diffy	< 3.4.1	3.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

The function that calls the diff tool in versions of Diffy prior to 3.4.1 does not properly handle double quotes in a filename when run in a Windows environment. This allows attackers to execute arbitrary commands via a crafted string.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-33127 advisory
https://github.com/samg/diffy/commit/478f392082b66d38f54a02b4bb9c41be32fd6593 web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/diffy/CVE-2022-33127.yml web
https://github.com/samg/diffy package
https://github.com/samg/diffy/blob/56fd935aea256742f7352b050592542d3d153bf6/CHANGELOG#L1 web