GHSA-9fh3-j99m-f4v7

Code injection in pdf_info

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-36231

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	pdf_info	<= 0.5.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

pdf_info 0.5.3 is vulnerable to Command Execution. An attacker using a specially crafted payload may execute OS commands by using command chaining because during object initalization there is no validation performed and the user provided path is used.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-36231 advisory
https://github.com/newspaperclub/pdf_info/issues/16 web
https://github.com/newspaperclub/pdf_info/pull/15 web
https://github.com/affix/CVE-2022-36231 web
https://github.com/newspaperclub/pdf_info package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pdf_info/CVE-2022-36231.yml web
https://rubygems.org/gems/pdf_info web