CVE-2017-2096 smalruby and smalruby-editor vulnerable to OS Command Injection
Remote attackers can execute arbitrary OS commands in smalruby-editor, requiring an upgrade to secure the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-2096?
CVE-2017-2096 is a critical command injection vulnerability in smalruby-editor, published on 28 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
smalruby-editor v0.4.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Weakness: CWE-78
Which versions are affected by CVE-2017-2096?
4 open source packages ship an affected version, including smalruby-editor and smalruby. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
smalruby-editor RubyGems | All versions | 0.4.1 |
smalruby-editor RubyGems | All versions | 0.4.1 |
smalruby RubyGems | All versions | 0.1.11 |
smalruby RubyGems | All versions | 0.1.11 |
Products include Smalruby Smalruby-Editor.
How do I fix CVE-2017-2096?
Upgrade smalruby-editor to 0.4.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-2096 being exploited?
There is no known exploitation of CVE-2017-2096 in the wild and no public exploit code.
Sources
Also known as GHSA-f489-655r-x6gr.