GHSA-99ch-8mvp-g7m5

md2pdf allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename

Source: GitHub Advisory Database (reviewed) Critical CVE-2013-1948

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	md2pdf	<= 0.0.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

`converter.rb` in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-1948 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/83416 web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/md2pdf/CVE-2013-1948.yml web
https://github.com/rwestgeest/md2pdf package
https://web.archive.org/web/20130503194109/http://www.securityfocus.com/bid/59061 web
http://vapid.dhs.org/advisories/md2pdf-remote-exec.html web