rgpg Code Injection vulnerability (GHSA-jg4m-q6w8-vrjp)
Published: 2017-10-24T18:33:37Z
Aliases: CVE-2013-4203
Severity: HIGH · CWE: CWE-94

The `self.run_gpg` function in `lib/rgpg/gpg_helper.rb` in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.

Affected packages:
package: ecosystem: RubyGems
name: rgpg
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.2.3