GHSA-qv32-5wm2-p32h

Command Injection in sequenceserver

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-42360

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	sequenceserver	< 3.1.2	3.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands ### Patches Fixed in 3.1.2 ### Workarounds No known workarounds

References

External links from the advisory. They lead to third-party sites.

https://github.com/wurmlab/sequenceserver/security/advisories/GHSA-qv32-5wm2-p32h web
https://nvd.nist.gov/vuln/detail/CVE-2024-42360 advisory
https://github.com/wurmlab/sequenceserver/commit/457e52709f7f9ed2fceed59b3db564cb50785dba web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sequenceserver/CVE-2024-42360.yml web
https://github.com/wurmlab/sequenceserver package