Ruby on Rails vulnerable to code injection (GHSA-rvpq-5xqx-pfpp)
Published: 2017-10-24T18:33:38Z
Aliases: CVE-2006-4111
Severity: HIGH · CWE: CWE-94

Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.

Affected packages:
package: ecosystem: RubyGems
name: rails
ranges: type: ECOSYSTEM
events: introduced: 1.1.0
fixed: 1.1.6