gollum and gollum-lib allow remote authenticated users to execute arbitrary code (GHSA-q97v-764g-r2rp)
Published: 2017-11-16T01:47:37Z
Aliases: CVE-2014-9489
Severity: HIGH · CWE: CWE-284

The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string `master` is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the `-O` or `--open-files-in-pager` flags.

Affected packages:
package: ecosystem: RubyGems
name: gollum
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.1.1
package: ecosystem: RubyGems
name: gollum-lib
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.0.1