ldoce Gem Arbitrary Command Execution (GHSA-g266-3crh-h7gj)
Published: 2017-10-24T18:33:37Z
Aliases: CVE-2013-1911
Severity: MODERATE · CWE: CWE-20

`lib/ldoce/word.rb` in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.

Affected packages:
package: ecosystem: RubyGems
name: ldoce
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.2