sprout Arbitrary Code Execution vulnerability (GHSA-229r-pqp6-8w6g)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2013-6421
Severity: HIGH · CWE: CWE-94

The `unpack_zip` function in `archive_unpacker.rb` in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.

Affected packages:
package: ecosystem: RubyGems
name: sprout
versions: 0.7.246