Creme Fraiche contains OS Command Injection (GHSA-m6f7-46hw-grcj)
Published: 2017-10-24T18:33:37Z
Aliases: CVE-2013-2090
Severity: CRITICAL · CWE: CWE-78

The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment.  NOTE: some of these details are obtained from third party information.

Affected packages:
package: ecosystem: RubyGems
name: cremefraiche
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.6.1