colorscore Command Injection vulnerability (GHSA-73qw-ww62-m54x)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2015-7541
Severity: CRITICAL · CWE: CWE-77

The initialize method in the Histogram class in `lib/colorscore/histogram.rb` in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) `image_path`, (2) `colors`, or (3) `depth` variable.

Affected packages:
package: ecosystem: RubyGems
name: colorscore
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.0.5