Skip to content

Command Injection

Critical
yannickwurm published GHSA-qv32-5wm2-p32h Aug 13, 2024

Package

bundler sequenceserver (RubyGems)

Affected versions

< 3.1.2

Patched versions

3.1.2

Description

Impact

Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands

Patches

Fixed in 3.1.2

Workarounds

No known workarounds

Severity

Critical

CVE ID

CVE-2024-42360

Weaknesses

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Learn more on MITRE.

Credits