sfpagent Command Injection vulnerability (GHSA-vm28-mrm7-fpjq)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2014-2888
Severity: HIGH · CWE: CWE-77

`lib/sfpagent/bsig.rb` in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request.

Affected packages:
package: ecosystem: RubyGems
name: sfpagent
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.4.15